UpHeron
All vulnerabilities

Servers and applications

GHSA-75v5-gj76-crfw

Anonymous disclosure of live streamer email and account fields via video API category listing

Severity
Medium 5.3
Published
13 Nov 2026
Last changed
13 Nov 2026
Added to UpHeron
13 Nov 2026
Weakness
Information exposure (CWE-200)
Attack
Over the network · No login needed · No user action needed
Attacker can
Read some data
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Sources
Project advisories (GitHub)

Description

The video API category listing can disclose a live streamer's email and account metadata to anonymous callers. Live rows bypassed the existing user-field sanitization because they have no filename.

An anonymous request to plugin/API/get.json.php?APIName=video&catName= can include live rows produced by getLiveVideosObject(). These rows contain streamer fields including email, emailVerified, isAdmin, canStream, canUpload and username. In get_api_video(), rows without a filename were skipped before removeSensitiveUserFields() ran.

Limited disclosure of streamer email and account metadata while the streamer is live. No passwords, session tokens or publishing credentials are exposed by this account-metadata issue. No integrity or availability impact is established.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N — 5.3 (Moderate).

The original report also describes exposure of stream identifiers and HLS URLs for password-protected public live streams.

From WWBN/AVideo's security advisory. Shortened; the full text is there.

Affected software

SoftwareAffected versions
AVideoServers and applications · github:wwbn/avideo
  • Every version up to 29.7.1

References