CVE-2026-89252 in AVideo
Summary
by MITRE • 09/11/2026
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to verify ownership in addLiveLink.php when updating LiveLinks, allowing authenticated users to modify other users' links. A canStream user can overwrite another user's LiveLink HLS source and metadata by supplying an existing linkId, redirecting viewers to attacker-controlled media.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/11/2026
The vulnerability identified in AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 represents a critical failure in object-level access control within the platform's live streaming management subsystem. Specifically, the flaw resides in the addLiveLink.php script, which is responsible for creating and updating LiveLinks associated with user accounts. The core technical deficiency is an absence of ownership verification when processing updates to existing links. In secure software design, any operation that modifies a resource owned by another entity must validate that the requesting authenticated user possesses administrative privileges or explicit permission over that specific resource ID. Here, the application accepts a linkId parameter and proceeds to update the associated HLS source URL and metadata without checking if the currently logged-in user is the original creator of that LiveLink. This oversight allows any authenticated user with canStream permissions to arbitrarily select an existing live stream identifier belonging to another user and overwrite its configuration parameters.
From a technical perspective, this vulnerability exploits the lack of server-side authorization checks during state-changing operations. When a request is made to update a LiveLink, the backend logic retrieves the record based on the provided linkId but fails to cross-reference it against the session's associated user ID or account permissions before applying the new values for HLS source and metadata. This behavior aligns with CWE-284, Improper Access Control, where insufficient restrictions are applied to ensure authorized users can only access appropriate resources. Furthermore, because the update operation directly modifies the media source URL that viewers connect to, it enables a form of session hijacking or content substitution at the infrastructure level rather than just data theft. The attacker does not need to compromise credentials; they merely need valid authentication tokens for their own account and knowledge of another user's live stream identifier, which is often publicly visible in streaming platforms.
The operational impact of this vulnerability is severe due to its potential for malicious redirection and content injection. An attacker can overwrite a legitimate broadcaster's HLS source with a URL pointing to an attacker-controlled media server. Consequently, viewers tuning into the victim's live stream are silently redirected to watch unauthorized or potentially harmful content hosted by the adversary. This capability facilitates several high-impact attack scenarios including phishing campaigns where fake login pages are streamed under the guise of a trusted entity, distribution of malware via malicious video files embedded in the stream metadata, and significant reputational damage for the victimized broadcaster whose brand is associated with inappropriate or illegal material. Additionally, this can be used to disrupt live events by replacing critical content with noise or offensive media, causing service disruption and loss of trust among the audience base.
This vulnerability also maps closely to MITRE ATT&CK technique T1565, Stored Data Manipulation, as the attacker modifies data stored on the server that is subsequently served to other users. It further relates to T1078, Valid Accounts, since exploitation requires initial authentication but leverages those valid credentials for unauthorized actions beyond their intended scope. The ability to redirect viewers constitutes a form of traffic interception and manipulation at the application layer, compromising the integrity and availability aspects of the CIA triad. While confidentiality is not directly breached in this specific vector as no sensitive data is exfiltrated, the integrity of the streaming service is fundamentally compromised, allowing an attacker to dictate what content is delivered to end-users without their knowledge or consent.
Mitigation strategies must focus on implementing strict object-level authorization checks within the addLiveLink.php endpoint and similar functions handling resource updates. The application logic should verify that the user ID associated with the current session matches the owner ID of the LiveLink being modified before allowing any write operations to proceed. If a user requires administrative capabilities over another user's content, such as in moderator roles, explicit permission checks must be implemented rather than relying on broad role-based access controls like canStream alone. Additionally, implementing rate limiting and anomaly detection for rapid updates to live stream configurations could help detect automated exploitation attempts. Input validation should also ensure that HLS source URLs are sanitized against known malicious patterns or unauthorized domains if domain whitelisting is part of the security policy. Regular code audits focusing on ownership verification in all CRUD operations are essential to prevent similar access control flaws across the platform's architecture.