CVE-2026-86721

AVideo through commit c3edcc274c is affected by an authorization bypass in saveLive.php and related endpoints. A session cookie named key with a known constant value value overrides the $_REQUEST['key'] parameter, allowing an unauthenticated attacker to publish to any user's RTMP stream and hijac...