CVE-2026-86726 in AVideo
Summary
by MITRE • 09/08/2026
AVideo through 29.0 contains an information disclosure vulnerability in restreamsActive.json.php that allows authenticated streamers to enumerate source stream keys and identities of all other streamers' active restreams. The endpoint fails to filter results by user ownership, exposing sensitive transmission credentials and streamer identity across all accounts to any user with streaming capability.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/08/2026
The vulnerability identified in AVideo versions up through 29.0 represents a critical failure in access control mechanisms within the platform's REST API layer, specifically affecting the restreamsActive.json.php endpoint. This component is designed to manage and display information regarding active restreaming configurations for users who have been granted streaming privileges. However, the underlying implementation lacks proper authorization checks that verify whether the requesting user has ownership or administrative rights over the specific data being retrieved. Instead of filtering results based on the authenticated identity's relationship to the target streamer accounts, the endpoint returns a comprehensive list of all active restreams across the entire platform. This architectural flaw effectively bypasses standard multi-tenant isolation principles, allowing any authenticated user with streaming capabilities to access sensitive operational data belonging to other users without explicit permission or context validation.
From a technical perspective, this vulnerability is classified as an insecure direct object reference combined with broken access control, aligning closely with CWE-284 Improper Access Control and CWE-200 Exposure of Sensitive Information to an Unauthorized Actor. The root cause lies in the server-side logic which queries the database for active restream configurations but fails to append a WHERE clause or equivalent filtering mechanism that restricts results to records associated with the current session's user ID. Consequently, the API endpoint acts as an unauthenticated enumeration vector for authenticated users, exposing not only metadata about stream destinations but also sensitive transmission credentials such as RTMP keys and server URLs. These credentials are typically treated as high-value secrets because they allow direct control over live video feeds, making their exposure particularly dangerous in a production environment where content creators rely on these tokens to push streams to third-party platforms like YouTube or Twitch securely.
The operational impact of this vulnerability is severe for both individual streamers and the platform provider itself. For streamers, the disclosure of source stream keys allows malicious actors to hijack live broadcasts by injecting unauthorized video feeds into existing channels using the stolen credentials. This can lead to content substitution, where legitimate streams are replaced with malicious or inappropriate material, causing significant reputational damage and potential legal liabilities for copyright infringement if pirated content is distributed via the compromised channel. Furthermore, the exposure of streamer identities facilitates targeted social engineering attacks, phishing campaigns, and doxxing efforts against high-profile users who may not have anticipated their operational details being publicly accessible within the application's internal API structure. For the platform provider, this represents a significant breach of trust and data integrity, potentially violating service level agreements regarding user privacy and security standards expected in video hosting services.
Mitigation strategies must focus on implementing strict identity-based access control checks at the API endpoint level. Developers should modify the restreamsActive.json.php logic to ensure that every query for active restream configurations includes a mandatory filter restricting results to only those records where the owner_id matches the authenticated user's account identifier. Additionally, it is advisable to implement rate limiting on this endpoint to prevent rapid enumeration attempts and to audit existing database queries for similar patterns of missing ownership validation across other API routes. Immediate patching to version 29.1 or later is required if available, as these updates typically include fixes for such access control flaws. In the interim, administrators should enforce strong password policies for stream keys and consider rotating exposed credentials immediately upon detection of exploitation activity. Monitoring logs for unusual patterns of bulk data retrieval from this endpoint can also aid in early detection of automated scanning tools attempting to exploit this weakness before significant damage occurs.