CVE-2026-92912: Use of Insufficiently Random Values

AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 uses cryptographically weak uniqid values for RTMP publish keys in LiveTransmition, reducing key entropy to approximately one million possibilities per creation second. Attackers who know the channel creation time can brute-force the...

CVE-2026-88874: Exposure of Sensitive Information to an Unauthorized Actor

AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 master, 2026-08-23 does not enforce the Live stream password check on the stats endpoint or on the HLS origin. Live::getStats plugin/Live/Live.php returns a password-protected transmission's RTMP stream key, its isPasswordProtected...

CVE-2026-86721

AVideo through commit c3edcc274c contains an authorization bypass vulnerability where a session cookie named 'key' with value 'value' overrides the $REQUEST'key' parameter in saveLive.php and related endpoints. Attackers can publish to any user's RTMP stream without authentication by using the...

CVE-2026-86721

AVideo through commit c3edcc274c is affected by an authorization bypass in saveLive.php and related endpoints. A session cookie named key with a known constant value value overrides the $_REQUEST['key'] parameter, allowing an unauthenticated attacker to publish to any user's RTMP stream and hijac...

CVE-2026-86721 AVideo through c3edcc274c Authorization Bypass via Session Cookie

AVideo through commit c3edcc274c contains an authorization bypass vulnerability where a session cookie named 'key' with value 'value' overrides the $REQUEST'key' parameter in saveLive.php and related endpoints. Attackers can publish to any user's RTMP stream without authentication by using the...

CVE-2026-86721 AVideo through c3edcc274c Authorization Bypass via Session Cookie

AVideo through commit c3edcc274c contains an authorization bypass vulnerability where a session cookie named 'key' with value 'value' overrides the $REQUEST'key' parameter in saveLive.php and related endpoints. Attackers can publish to any user's RTMP stream without authentication by using the...

EUVD-2026-72857

AVideo through commit c3edcc274c contains an authorization bypass vulnerability where a session cookie named 'key' with value 'value' overrides the $REQUEST'key' parameter in saveLive.php and related endpoints. Attackers can publish to any user's RTMP stream without authentication by using the...

CVE-2026-86721: Improper Authentication

AVideo through commit c3edcc274c contains an authorization bypass vulnerability where a session cookie named 'key' with value 'value' overrides the $REQUEST'key' parameter in saveLive.php and related endpoints. Attackers can publish to any user's RTMP stream without authentication by using the...

PT-2026-87118

AVideo through commit c3edcc274c contains an authorization bypass vulnerability where a session cookie named 'key' with value 'value' overrides the $ REQUEST'key' parameter in saveLive.php and related endpoints. Attackers can publish to any user's RTMP stream without authentication by using the...

CVE-2026-85162

AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in plugin/Live/saveLive.php that lacks forbidIfNotPost and forbidIfInvalidToken protections. Attackers can craft malicious image tags to overwrite authenticated streamers' RTMP keys, passwords, and titles, hijacki...

CVE-2026-85162 AVideo through c91b5975d CSRF via saveLive.php

AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in plugin/Live/saveLive.php that lacks forbidIfNotPost and forbidIfInvalidToken protections. Attackers can craft malicious image tags to overwrite authenticated streamers' RTMP keys, passwords, and titles, hijacki...

CVE-2026-85162 AVideo through c91b5975d CSRF via saveLive.php

AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in plugin/Live/saveLive.php that lacks forbidIfNotPost and forbidIfInvalidToken protections. Attackers can craft malicious image tags to overwrite authenticated streamers' RTMP keys, passwords, and titles, hijacki...

EUVD-2026-70397

AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in plugin/Live/saveLive.php that lacks forbidIfNotPost and forbidIfInvalidToken protections. Attackers can craft malicious image tags to overwrite authenticated streamers' RTMP keys, passwords, and titles, hijacki...

CVE-2026-85162

AVideo (through commit c91b5975d) contains a cross-site request forgery (CSRF) vulnerability in plugin/Live/saveLive.php , which lacks forbidIfNotPost and forbidIfInvalidToken protections. An attacker can craft malicious image tags to overwrite authenticated streamers' RTMP keys, passwords, and t...

PT-2026-84994

AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in plugin/Live/saveLive.php that lacks forbidIfNotPost and forbidIfInvalidToken protections. Attackers can craft malicious image tags to overwrite authenticated streamers' RTMP keys, passwords, and titles, hijacki...

CVE-2026-85162: Cross-Site Request Forgery (CSRF)

AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in plugin/Live/saveLive.php that lacks forbidIfNotPost and forbidIfInvalidToken protections. Attackers can craft malicious image tags to overwrite authenticated streamers' RTMP keys, passwords, and titles, hijacki...

CVE-2026-84187

AVideo contains a missing authentication vulnerability in plugin/Live/onpublish.php that allows unauthenticated attackers to mark arbitrary scheduled broadcasts as failed by sending crafted POST requests with schedule identifiers. Attackers can exploit the unguarded RTMP callback endpoint to modi...

EUVD-2026-69024

AVideo contains a missing authentication vulnerability in plugin/Live/onpublish.php that allows unauthenticated attackers to mark arbitrary scheduled broadcasts as failed by sending crafted POST requests with schedule identifiers. Attackers can exploit the unguarded RTMP callback endpoint to modi...

CVE-2026-84187 AVideo on_publish.php Missing Authentication Check via RTMP Callback

AVideo contains a missing authentication vulnerability in plugin/Live/onpublish.php that allows unauthenticated attackers to mark arbitrary scheduled broadcasts as failed by sending crafted POST requests with schedule identifiers. Attackers can exploit the unguarded RTMP callback endpoint to modi...

CVE-2026-84187 AVideo on_publish.php Missing Authentication Check via RTMP Callback

AVideo contains a missing authentication vulnerability in plugin/Live/onpublish.php that allows unauthenticated attackers to mark arbitrary scheduled broadcasts as failed by sending crafted POST requests with schedule identifiers. Attackers can exploit the unguarded RTMP callback endpoint to modi...