CVE-2026-86720 in AVideo
Summary
by MITRE • 09/08/2026
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate ownership of live_restreams_id in resendRestreamer.json.php, allowing authenticated users with canStream to access other users' restream destinations. Attackers can broadcast their live stream to victim-configured restream destinations by supplying arbitrary live_restreams_id values, hijacking YouTube, Facebook, or Twitch streams using victim stream keys.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/08/2026
The vulnerability identified in WWBN AVideo represents a critical failure in access control mechanisms within the platform's live streaming infrastructure. Specifically located in the resendRestreamer.json.php endpoint and introduced via commit c3edcc274c389816d434acadac07ee78eaf330c1, this flaw stems from an insufficient validation of resource ownership for the live_restreams_id parameter. In a properly secured system, any request to modify or utilize resources associated with a specific user account must verify that the authenticated requester is indeed the owner of those resources. However, in this instance, the application accepts arbitrary values for the live_restreams_id field without cross-referencing them against the permissions and ownership data tied to the currently authenticated session. This oversight allows any user possessing the canStream permission, which is relatively common among content creators on such platforms, to manipulate restreaming configurations belonging to other users.
From a technical perspective, this flaw constitutes an Insecure Direct Object Reference (IDOR), categorized under CWE-639 in the Common Weakness Enumeration standard. The attacker exploits the predictable or easily guessable nature of identifiers by supplying arbitrary live_restreams_id values that correspond to target victims' configurations. By doing so, the application erroneously grants access to these resources based solely on the presence of a valid authentication token and the canStream privilege level, rather than verifying actual ownership. This lack of server-side authorization checks enables an attacker to intercept control over the victim's restreaming setup without needing elevated privileges or compromising other accounts beyond basic streaming capabilities.
The operational impact of this vulnerability is severe due to its potential for stream hijacking and reputation damage. An authenticated attacker can broadcast their own live content into a victim-configured destination, such as YouTube, Facebook Live, or Twitch. This effectively allows the attacker to impersonate the victim by broadcasting under the victim's established channel identity using the victim's unique stream keys. Such actions can lead to significant reputational harm for the victim if inappropriate or malicious content is broadcasted publicly. Furthermore, this capability facilitates phishing attacks where attackers might direct viewers from a trusted source to malicious websites hosted during the hijacked stream segment. The integrity of live streaming events is compromised as third parties gain unauthorized control over distribution channels that are critical for brand consistency and audience trust.
Mitigation strategies must focus on implementing robust authorization checks at the application logic level. Developers should ensure that every request involving resource modification, particularly those affecting restreaming destinations, includes a strict verification step confirming that the authenticated user is the legitimate owner of the specified live_restreams_id. This involves querying the database to validate ownership before processing any changes or initiating broadcasts. Additionally, implementing rate limiting and anomaly detection for stream key usage can help identify suspicious patterns indicative of hijacking attempts. From an architectural standpoint, adopting a principle of least privilege ensures that users only have access to resources explicitly assigned to them, thereby reducing the attack surface for IDOR vulnerabilities. Regular security audits focusing on authentication and authorization flows are essential to prevent similar flaws in future updates.
This vulnerability aligns with MITRE ATT&CK technique T1078, Valid Accounts, as it leverages legitimate credentials to perform unauthorized actions within an application environment. It also reflects aspects of T1534, Internal Spearphishing, if the hijacked streams are used to deceive viewers into clicking malicious links or providing sensitive information during a live broadcast event. Addressing this issue requires immediate patching of the resendRestreamer.json.php endpoint and a comprehensive review of other endpoints handling user-specific resources to ensure consistent enforcement of ownership validation across all application modules.