CVE-2026-89250 WWBN CVE debrief

Who should care

Defenders responsible for AVideo installations and systems that interact with recorded video files should assess exposure and implement compensating controls to restrict access to recorded video files. This includes security teams, vulnerability management teams, and operators of AVideo systems. They should prioritize verifying exposure and implementing compensating controls to restrict access to recorded video files, as well as monitoring for suspicious

Why it matters

The unauthenticated file read vulnerability in AVideo's getRecordedFile.php endpoint allows attackers to download recorded live video files without authentication, potentially leading to unauthorized access and data exposure.

• Potential unauthorized access to recorded video files
• Possible data exposure through unauthenticated file downloads

Technical summary

The getRecordedFile.php endpoint in AVideo allows unauthenticated attackers to download recorded live video files by requesting the endpoint with a known or guessed stream key. This vulnerability has a high CVSS score of 8.7, indicating a significant risk to affected systems. Defenders should prioritize verifying exposure and implementing compensating controls to restrict access to recorded video files. The vulnerability affects AVideo installations and systems that interact with recorded video files, potentially leading to unauthorized access and data exposure.

Defensive priority

Defenders should prioritize verifying exposure and implementing compensating controls.

Recommended defensive actions

• Verify AVideo installations for exposure to the getRecordedFile.php endpoint
• Implement compensating controls to restrict access to recorded video files
• Monitor for suspicious requests to the getRecordedFile.php endpoint
• Review vendor guidance for AVideo
• Conduct an exposure review for AVideo systems
• Inventory AVideo assets for prioritized remediation
• Track AVideo updates and patches

Evidence notes

The CVE description and source references indicate an unauthenticated file read vulnerability in AVideo's getRecordedFile.php endpoint, allowing attackers to download recorded live video files without authentication. The vulnerability is confirmed to exist in AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1. Defenders should verify exposure and implement compensating controls to restrict access to recorded video files.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.