CVE-2026-88865 AVideo Missing Authorization via getRestream.json.php

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate restream ownership in getRestream.json.php, allowing authenticated users with canStream permission to mint tokens for arbitrary restreams. Attackers can exchange the token to retrieve other users' stream keys from...

CVE-2026-88865 AVideo Missing Authorization via getRestream.json.php

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate restream ownership in getRestream.json.php, allowing authenticated users with canStream permission to mint tokens for arbitrary restreams. Attackers can exchange the token to retrieve other users' stream keys from...

CVE-2026-88865

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate restream ownership in getRestream.json.php . Authenticated users holding the canStream permission can mint tokens for arbitrary restreams, then exchange those tokens to retrieve other users' stream keys from getLiveK...

CVE-2026-88865 AVideo Missing Authorization via getRestream.json.php

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate restream ownership in getRestream.json.php, allowing authenticated users with canStream permission to mint tokens for arbitrary restreams. Attackers can exchange the token to retrieve other users' stream keys from...

CVE-2026-88865: Authorization Bypass Through User-Controlled Key

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate restream ownership in getRestream.json.php, allowing authenticated users with canStream permission to mint tokens for arbitrary restreams. Attackers can exchange the token to retrieve other users' stream keys from...

PT-2026-89376

Name of the Vulnerable Software and Affected Versions AVideo versions prior to commit c3edcc274c389816d434acadac07ee78eaf330c1 Description Authenticated users with canStream permission can mint tokens for arbitrary restreams because the software fails to validate restream ownership in the...