Description

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an unauthenticated file read vulnerability in the getRecordedFile.php endpoint that streams recorded FLV files from the temporary directory. Attackers can request the endpoint with a known or guessed stream key to download recorded live video files without authentication or authorization checks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-11T12:16:55.063Z",
  "pubdate": "2026-09-11T12:16:55.063Z",
  "executiveSummary": "WWBN AVideo, up to commit c3edcc274c389816d434acadac07ee78eaf330c1, is susceptible to an unauthenticated file read vulnerability residing in the getRecordedFile.php endpoint.\nThis flaw enables unauthorized actors to exfiltrate sensitive recorded FLV video files stored in the system's temporary directory without requiring valid session credentials or authorization.\nThe vulnerability stems from a lack of access control checks within the file retrieval process, exposing live recording data to any entity capable of interacting with the web server.\nThe impact is significant, as it facilitates the unauthorized disclosure of private or sensitive video content, potentially leading to a total breach of data confidentiality for recorded streams.\nExploitation is straightforward, requiring only knowledge of the target's internal stream key naming convention or successful brute-force guessing of the file identifiers.\nThere are no requirements for administrative privileges or authentication, meaning the attack surface is exposed to the public internet if the AVideo instance is network-accessible.",
  "technicalDetails": "The vulnerability is localized within the getRecordedFile.php script, which is designed to handle the streaming of FLV files captured during live broadcasts. The root cause of this security defect is the absence of server-side authentication and authorization verification before processing a file retrieval request.\nUnder normal operating conditions, the application expects an authenticated user to initiate a file request. However, the implementation of getRecordedFile.php fails to validate the session state or verify if the requester has permissions to access the specified resource.\nThe attack flow begins when an adversary identifies the target endpoint. Since the script uses stream keys as a primary identifier for locating files within the temporary directory, an attacker can enumerate or predict these keys. By constructing a crafted HTTP request directed at getRecordedFile.php and supplying a valid or guessed stream key in the parameters, the attacker forces the application to read the associated FLV file from the filesystem.\nBecause the server lacks explicit checks for the caller's identity or current session validity, the script executes the file read operation regardless of the request's origin. The application proceeds to stream the contents of the target FLV file directly back to the HTTP response, effectively facilitating an unauthorized file read.\nThe technical limitation is strictly procedural: the script assumes that requests reaching this endpoint are inherently trusted or that the secrecy of the stream key serves as a sufficient security boundary. This approach is fundamentally flawed as it relies on security-by-obscurity rather than robust access control lists (ACLs) or session token verification.\nPost-exploitation, the attacker gains full access to the underlying media files. Given that these recordings may contain sensitive information, private conversations, or proprietary content, the exposure represents a critical confidentiality failure. The vulnerability does not appear to provide remote code execution (RCE) capabilities, but it constitutes a severe information disclosure vector that bypasses all intended security policies of the AVideo platform."
}