CVE-2026-126541

{
  "etk_id": "ETK-2026-4137",
  "cve_id": "CVE-2026-126541",
  "display_id": "CVE-2026-126541",
  "ghsa_id": "GHSA-5m6p-rj9g-rr93",
  "euvd_id": "EUVD-2026-123066",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Authorization bypass in WWBN AVideo Live restreaming",
  "summary": "WWBN AVideo through 29.7.1 has an authorization flaw in Live plugin restream functionality. An authenticated streamer may access another user's stream credentials, enabling stream impersonation or relaying of private and pay-per-view broadcasts.",
  "mitigation": "Restrict or disable Live-plugin restream access for untrusted streamer accounts, and rotate affected stream credentials. Apply an upstream update that addresses this issue when a confirmed fixed release is available.",
  "vendor": "WWBN",
  "product": "AVideo",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 29.7.1"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "AVideo",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 8.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 20.939540033333333,
  "t0_at": "2026-11-11T00:58:53.392000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-11T04:38:30.588465+00:00",
      "days": 0.15251384797453704,
      "is_lower_bound": false,
      "measured_at": "2026-11-11T00:58:53.392000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-11-11T00:58:53.392000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-11T00:58:53.392000+00:00",
      "url": "https://github.com/advisories/GHSA-5m6p-rj9g-rr93"
    }
  }
}