VA-26-232-01 — Brushfire unauthenticated information disclosure

Summary

The Brushfire platform's video content streaming application (https://online.brushfire.com) exposes database path in requests to users, allowing a remote, unauthenticated attacker to read information about other users.

Vulnerabilities 1

Medium 5.3

CVE-2026-75928

Brushfire unauthenticated information disclosure

The Brushfire platform's video content streaming application (https://online.brushfire.com) exposes database path in requests to users, allowing a remote, unauthenticated attacker to read information about other users. Fixed February 2026.

Brushfire Online Experience

Aug 21, 2026

Revision history

2026-08-21 #1.0.0
Initial publication