What is GHSA-cgc3-3gxq-qpxj?

GHSA-cgc3-3gxq-qpxj is a security advisory published by GitHub Security Advisories with High severity. WWBN AVideo through 29.0 fails to enforce user-group restrictions in the plugin/Live/stats.json...

Which CVE IDs does GHSA-cgc3-3gxq-qpxj cover?

GHSA-cgc3-3gxq-qpxj covers the following CVE IDs: CVE-2026-91965. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-cgc3-3gxq-qpxj?

GHSA-cgc3-3gxq-qpxj has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

GHSA-cgc3-3gxq-qpxjHighCVSS 7.5

WWBN AVideo through 29.0 fails to enforce user-group restrictions in the plugin/Live/stats.json...

Vendor

GitHub Security Advisories

Published

September 15, 2026

Last Modified

September 15, 2026

🔗 CVE IDs covered (1)

CVE-2026-91965 →

📋 Description

WWBN AVideo through 29.0 fails to enforce user-group restrictions in the plugin/Live/stats.json.php and plugin/Live/calendar.json.php endpoints. Unauthenticated attackers can retrieve restricted live transmission details including stream keys, titles, descriptions, owner information, and direct HLS playback URLs by accessing these endpoints.

🔗 References (4)

https://github.com/WWBN/AVideo/security/advisories/GHSA-4xhp-wjpj-p92w
https://nvd.nist.gov/vuln/detail/CVE-2026-91965
https://www.vulncheck.com/advisories/wwbn-avideo-through-29.0-broken-access-control-via-live-endpoints
https://github.com/advisories/GHSA-cgc3-3gxq-qpxj