Security Advisory

CVE-2026-86720

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-09-08 15:13:54

Last updated 2026-09-08 15:34:51

Assigner VulnCheck

CVSS score 8.6

State PUBLISHED

Description

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate ownership of live_restreams_id in resendRestreamer.json.php, allowing authenticated users with canStream to access other users' restream destinations. Attackers can broadcast their live stream to victim-configured restream destinations by supplying arbitrary live_restreams_id values, hijacking YouTube, Facebook, or Twitch streams using victim stream keys.

← Browse all CVEs View on cve.org ↗