Please report security issues to developer@streamphp.com
Security: WWBN/AVideo
Security
.github/SECURITY.md
-
Broken Access Control: two unauthenticated Live endpoints publish user-group-restricted live transmissions, including the stream key and the unprotected HLS playlist URLGHSA-4xhp-wjpj-p92w published
Aug 31, 2026 by DanielnetoDotComHigh -
Unauthenticated blind Host-header SSRF in WWBNIndex check_site_availability()GHSA-rqg6-qcjv-55w5 published
Aug 31, 2026 by DanielnetoDotComModerate -
Authenticated blind SSRF via stored videoLink get_headers() in getHeaderContentTypeFromURLGHSA-vjgr-5x63-cq96 published
Aug 31, 2026 by DanielnetoDotComModerate -
Missing authorization: `APIName=adsInfo` on a password-protected video returns the owner `users_id` and per-user ad creativesGHSA-989c-frwf-gprj published
Aug 28, 2026 by DanielnetoDotComModerate -
Missing authorization: `plugin/Scheduler/sendEmail.json.php` dumps and sends any scheduler email job using the site-wide `getToken()`GHSA-qq59-3jwp-hgj9 published
Aug 28, 2026 by DanielnetoDotComHigh -
Missing authorization: `objects/playlistsFromUser.json.php` returns another user's private Favorite and Watch Later lists to guestsGHSA-6382-hm4f-hxqg published
Aug 28, 2026 by DanielnetoDotComModerate -
Missing authentication: POST `plugin/TopMenu/menuItems.json.php` dumps items on inactive admin menus including secret query URLsGHSA-h964-rxm2-fpgj published
Aug 28, 2026 by DanielnetoDotComModerate -
Missing authorization: `objects/playListAddVideo.json.php` adds a password-protected VOD to the caller's playlist without `canWatchVideo`GHSA-xhg9-rc5h-rp65 published
Aug 28, 2026 by DanielnetoDotComModerate -
Missing authentication: `plugin/TopMenu/menus.json.php` dumps all menus including inactive admin-only rowsGHSA-9xrr-c5w3-f5p7 published
Aug 28, 2026 by DanielnetoDotComModerate -
Missing authorization: `plugin/Live/remindMe.json.php` creates scheduler reminders for another user's private live scheduleGHSA-qf26-4xp7-q5h9 published
Aug 28, 2026 by DanielnetoDotComModerate
Learn more about advisories related to WWBN/AVideo in the GitHub Advisory Database