CVE-2026-89252

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in addLiveLink.php when updating LiveLinks. The component fails to verify ownership, allowing any authenticated canStream user to overwrite another user's LiveLink HLS source and metadata...

CVE-2026-89252 AVideo Missing Authorization in addLiveLink.php LiveLink Update

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to verify ownership in addLiveLink.php when updating LiveLinks, allowing authenticated users to modify other users' links. A canStream user can overwrite another user's LiveLink HLS source and metadata by supplying an existing...