CVE-2026-89252: Wwbn Avideo

Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days.

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to verify ownership in addLiveLink.php when updating LiveLinks, allowing authenticated users to modify other users' links. A canStream user can overwrite another user's LiveLink HLS source and metadata by supplying an existing linkId, redirecting viewers to attacker-controlled media.

Affected products

• Wwbn Avideo

Published 2026-09-11. Last modified 2026-09-15.