CVE-2026-40907: 
PHP vulnerability analysis and mitigation

CVE-2026-40907 is an Insecure Direct Object Reference (IDOR) vulnerability in WWBN AVideo, an open source video platform, affecting versions 29.0 and prior. The flaw resides in the endpoint plugin/Live/view/Live_restreams/list.json.php and allows any authenticated user with streaming permission to retrieve other users' live restream configurations, including RTMP stream keys and OAuth tokens for YouTube Live, Facebook Live, and Twitch. It was published on April 21, 2026, and carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory).

The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key). The authorization logic in list.json.php only enforces user-scoping when the users_id GET parameter is absent — if a non-admin user explicitly supplies ?users_id=<victim_id>, the override that forces the parameter to the authenticated user's own ID is never reached, and the attacker-controlled value passes directly to Live_restreams::getAllFromUser(). This function executes an unsanitized SQL query (SELECT * FROM live_restreams WHERE users_id = $users_id), returning all columns including stream_key, stream_url, and a parameters JSON blob containing access_token, refresh_token, and expires_at. Other endpoints in the same directory (e.g., delete.json.php) correctly implement an ownership check, making this an isolated logic flaw (GitHub Advisory).

Successful exploitation allows an authenticated attacker to harvest third-party platform stream keys and OAuth tokens (access and refresh tokens) for all users who have configured live restreaming. Stolen RTMP stream keys enable unauthorized broadcasting of arbitrary content to victims' YouTube, Facebook, or Twitch channels. Stolen refresh tokens can be used to obtain new access tokens, providing persistent access to victims' third-party accounts. Because user IDs are sequential integers, an attacker can trivially enumerate all platform users' credentials in a single automated sweep (GitHub Advisory).

A proof-of-concept exploit is publicly documented in the GitHub Security Advisory, consisting of a simple curl command with a manipulated users_id parameter. Exploitation requires only a valid authenticated session with streaming permission — no admin privileges or special conditions are needed. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.028% (GitHub Advisory).

1. Reconnaissance: Identify an AVideo instance running version 29.0 or earlier. Confirm the Live plugin is enabled and that the target endpoint plugin/Live/view/Live_restreams/list.json.php is accessible.
2. Obtain a valid session: Register or log in as any user account that has been granted streaming permission. Capture the PHPSESSID session cookie.
3. Enumerate user IDs: Since user IDs are sequential integers, iterate through values (e.g., users_id=1, users_id=2, etc.) to identify accounts with configured restreams.
4. Send the IDOR request: Issue a crafted HTTP GET request supplying a victim's user ID:

   curl -s -b 'PHPSESSID=<attacker_session>' \
     'https://target.com/plugin/Live/view/Live_restreams/list.json.php?users_id=1'

5. Harvest credentials: Parse the JSON response to extract stream_key, stream_url, and the parameters field containing access_token and refresh_token for third-party platforms.
6. Abuse stolen credentials: Use the RTMP stream key to broadcast unauthorized content to the victim's channel, or use the refresh token to obtain new OAuth access tokens for persistent account access (GitHub Advisory).

• Network: Repeated HTTP GET requests to /plugin/Live/view/Live_restreams/list.json.php with varying users_id parameter values from a single source IP, particularly sequential integer enumeration (e.g., ?users_id=1, ?users_id=2, ...).
• Logs: Web server access logs showing a single authenticated session querying the list.json.php endpoint for multiple different users_id values in rapid succession; 200 OK responses returning JSON payloads with stream_key and parameters fields.
• Application Behavior: Unexpected live streams appearing on victims' YouTube, Facebook, or Twitch channels not initiated by the account owner; OAuth token refresh activity from unfamiliar IP addresses on third-party platforms (GitHub Advisory).

The fix is available in commit d5992fff2811df4adad1d9fc7d0a5837b882aed7, which unconditionally forces non-admin users to their own user ID regardless of whether the users_id parameter is supplied, removing the flawed empty() check. Administrators should apply this patch immediately or upgrade to any AVideo release that includes it. As an interim workaround, restrict access to the plugin/Live/view/Live_restreams/list.json.php endpoint at the web server level (e.g., via .htaccess or reverse proxy rules) until the patch can be applied. Users who may have been affected should revoke and rotate their third-party platform stream keys and OAuth tokens (GitHub Advisory, Patch Commit).