WWBN AVideo contains an unauthenticated information disclosure vulnerability that allows attackers to retrieve sensitive stream credentials, posing a significant risk to user account integrity.

The application fails to properly validate cryptographic tokens used in the getLiveKey.json.php endpoint, allowing an unauthenticated attacker to forge valid tokens and bypass access controls to retrieve stream_key and stream_url data.

Successful exploitation allows unauthorized third parties to hijack or monitor live streams hosted on external platforms like YouTube, Facebook, and Twitch. This results in direct loss of intellectual property, potential brand damage, and a complete compromise of the affected user's streaming account security. Given the high CVSS score of 8.6, this vulnerability represents a critical threat to the confidentiality of user data.

Immediate Action: Review the official security advisory at the provided GitHub repository and apply the latest available patches or updates to the AVideo instance.

Proactive Monitoring: Monitor server access logs for anomalous requests directed at the getLiveKey.json.php endpoint, particularly those containing forged tokens or unusual parameter structures.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block unauthorized or suspicious access to the /plugin/Live/view/Live_restreams/ directory until a patch is applied.

Public Exploit Available: No (the vulnerability is documented via research write-ups, but no weaponized exploit or public PoC is confirmed in the provided data).

The severity of this credential disclosure flaw necessitates immediate attention. Administrators must prioritize the application of vendor-supplied patches to close the cryptographic vulnerability. If patching is delayed, restricting network access to the affected endpoint is essential to prevent unauthorized credential harvesting by remote, unauthenticated attackers.