CVE-2026-86721 in AVideo
Summary
by MITRE • 09/08/2026
AVideo through commit c3edcc274c contains an authorization bypass vulnerability where a session cookie named 'key' with value 'value' overrides the $_REQUEST['key'] parameter in saveLive.php and related endpoints. Attackers can publish to any user's RTMP stream without authentication by using the known constant stream key value to hijack live broadcasts.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/08/2026
The vulnerability identified within AVideo, specifically linked to commit c3edcc274c, represents a critical authorization bypass that undermines the integrity of live streaming operations. This flaw stems from improper handling of session data versus request parameters in the backend logic governing RTMP stream management. The core technical issue lies in how the application processes incoming requests for saving or managing live streams. Specifically, in files such as saveLive.php and related endpoints, the code prioritizes a hardcoded or predictable constant value over user-supplied input without adequate validation of session context. This architectural oversight allows an attacker to manipulate the stream key parameter by injecting a specific cookie named 'key' with the value 'value'. Because this cookie value is known and static, it effectively overrides any authentication checks that rely on dynamic per-user keys, creating a predictable entry point for unauthorized access.
From a technical perspective, this vulnerability exploits the principle of insecure direct object references combined with broken access control mechanisms. The application fails to verify whether the session associated with the request actually owns the target stream key or has permission to modify it. Instead, by setting the 'key' cookie to 'value', an attacker forces the server to accept requests as if they were authenticated for any arbitrary user's live broadcast channel. This bypasses the intended authentication layer entirely, allowing external actors to inject content into streams that are meant to be private or restricted to specific broadcasters. The flaw is particularly dangerous because it does not require complex exploitation techniques; a simple HTTP request with the appropriate cookie header is sufficient to hijack the stream configuration.
The operational impact of this vulnerability is severe for both individual users and platform administrators who rely on AVideo for live broadcasting services. Attackers can publish malicious content, such as phishing links, malware distribution payloads, or inappropriate material, directly into any user's RTMP stream without prior authentication. This not only disrupts the legitimate broadcast but also damages the reputation of the affected broadcaster and potentially exposes their audience to security risks. Furthermore, this capability could be leveraged for more sophisticated attacks, including man-in-the-middle scenarios where attackers intercept and alter live video feeds in real-time, or use the compromised stream infrastructure as a vector for distributing malicious scripts to viewers who trust the source.
This vulnerability aligns with CWE-287, which describes Improper Authentication, specifically regarding the failure to correctly verify identity before granting access to resources. It also maps closely to MITRE ATT&CK technique T1078, Valid Accounts, as it involves using valid credentials or tokens in an unauthorized manner to gain persistence and control over a system resource. Additionally, aspects of CWE-639, Authorization Bypass Through User-Controlled Key, are evident given the manipulation of the stream key parameter via cookie injection.
To mitigate this risk, immediate action is required on both the application code level and infrastructure configuration levels. Developers must refactor the authentication logic in saveLive.php to ensure that session validation strictly checks for ownership of the requested resource rather than relying solely on static or predictable keys. Implementing strict input validation and ensuring that cookie values are not used as primary authorization tokens without additional cryptographic verification is essential. Furthermore, rotating all existing stream keys across the platform is necessary to invalidate any previously exploited credentials. Administrators should also enforce HTTPS for all administrative endpoints to prevent cookie interception via network sniffing and consider implementing rate limiting on live stream management APIs to detect and block automated exploitation attempts. Regular security audits focusing on access control logic in media handling modules will help prevent similar vulnerabilities from being introduced in future updates.