Is CVE-2026-86727 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-86727?

CVE-2026-86727 has a CVSS v3 severity of HIGH (7.5).

Back

CVE-2026-86727

Description

AVideo through 29.0 contains an information disclosure vulnerability in plugin/Live/stats.json.php that allows unauthenticated attackers to retrieve stream keys and m3u8 URLs by accessing the endpoint without authentication. Attackers can enumerate private, unlisted, and group-restricted live streams by parsing the hidden_applications array in the JSON response to obtain sensitive streaming credentials.