CVE-2026-85162 in AVideo
Summary
by MITRE • 09/03/2026
AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in plugin/Live/saveLive.php that lacks forbidIfNotPost and forbidIfInvalidToken protections. Attackers can craft malicious image tags to overwrite authenticated streamers' RTMP keys, passwords, and titles, hijacking live broadcasts.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/03/2026
The identified vulnerability resides within the AVideo platform's Live plugin, specifically in the saveLive.php endpoint, which is responsible for managing live streaming configurations such as Real-Time Messaging Protocol (RTMP) credentials and broadcast metadata. This component suffers from a critical Cross-Site Request Forgery (CSRF) flaw due to the absence of essential security controls designed to verify the legitimacy of incoming requests. Specifically, the code fails to implement forbidIfNotPost checks or validate anti-CSRF tokens before processing state-changing operations. In standard web application architecture, these mechanisms serve as primary defenses against CSRF attacks by ensuring that modifications are initiated only via intended POST methods and accompanied by unique, unpredictable session-specific tokens generated on the server side. Without these protections, any authenticated user who visits a maliciously crafted webpage can trigger unintended actions within their active AVideo session without their knowledge or consent.
The operational impact of this vulnerability is severe for live streamers utilizing the platform. An attacker can craft HTML pages containing hidden form submissions or image tags that exploit the browser's automatic inclusion of cookies and authentication headers when making requests to the vulnerable endpoint. By doing so, an adversary can overwrite critical streaming parameters associated with a victim’s account. This includes modifying RTMP keys and passwords, which are essential for broadcasting video content to servers like YouTube, Twitch, or custom ingest points. Additionally, attackers can alter stream titles and other metadata. The ability to hijack these credentials allows the attacker to redirect live broadcasts to their own controlled endpoints, effectively stealing audience attention, potentially injecting malicious content into legitimate streams, or disrupting ongoing broadcasts entirely. This represents a significant breach of integrity for both individual creators and organizations relying on AVideo for professional broadcasting services.
From a technical classification perspective, this vulnerability aligns with CWE-352, which defines Cross-Site Request Forgery as an attack that forces an end user to execute unwanted actions on a web application in which they are currently authenticated. The lack of token validation and method restriction places the application squarely within this category. Furthermore, from the MITRE ATT&CK framework perspective, this exploit technique falls under T1076, known as Remote Desktop Protocol Abuse or more broadly under Web Session Manipulation techniques where an attacker leverages valid user sessions to perform actions. The specific action of modifying stream credentials and titles can also be viewed through the lens of T1534, Internal Spearphishing if delivered via social engineering links, but fundamentally it is a direct exploitation of session management weaknesses in state-changing HTTP requests.
To mitigate this vulnerability, immediate remediation steps must focus on implementing robust CSRF protection mechanisms within the saveLive.php script and similar endpoints across the AVideo platform. Developers should integrate server-side anti-CSRF tokens that are unique per user session and validated upon every POST request intended to modify data. Additionally, enforcing strict HTTP method checks to ensure only POST requests trigger these sensitive operations is crucial. Implementing the SameSite cookie attribute with a value of Strict or Lax can further mitigate risks by preventing browsers from sending cookies in cross-site contexts. For users currently running affected versions, it is advisable to update to the patched version released after commit c91b5975d if available, or apply manual code patches that introduce these missing security checks until an official fix is deployed. Regular security audits and static analysis of web forms are recommended to prevent similar oversights in future development cycles.