CVE-2026-92912 in AVideo
Summary
by MITRE • 09/17/2026
AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 uses cryptographically weak uniqid() values for RTMP publish keys in LiveTransmition, reducing key entropy to approximately one million possibilities per creation second. Attackers who know the channel creation time can brute-force the five-digit microsecond component to forge valid stream keys and broadcast content as the channel owner.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified in AVideo stems from an insufficient randomness implementation within its LiveTransmition feature, specifically concerning the generation of RTMP publish keys. These keys are critical for authenticating streaming clients against the server, ensuring that only authorized users can broadcast content to a specific channel. The root cause lies in the use of PHP's uniqid() function to generate these authentication tokens. While uniqid is designed to create unique identifiers based on the current time measured in seconds and microseconds, it lacks cryptographic security properties. It does not utilize a cryptographically secure random number generator (CSPRNG) but rather relies on predictable system timing data. This design choice results in significantly reduced entropy for the generated keys, making them susceptible to prediction attacks if an attacker can estimate or observe the time of key generation with reasonable accuracy.
The technical flaw is characterized by a severe reduction in the search space required to brute-force valid stream keys. The uniqid function typically produces identifiers that include a microsecond component derived from system clock data. In this specific implementation, the entropy associated with these timestamps is limited such that there are approximately one million possible values generated per second of operation. For an attacker who can determine or guess the approximate time at which a channel's stream key was created, the effective search space shrinks dramatically to just those microsecond variations within that single second window. This transforms what should be a computationally infeasible brute-force attack into a trivial task for modern computing hardware capable of generating millions of hash comparisons per second.
From an operational perspective, this vulnerability allows unauthorized actors to forge valid RTMP publish keys and broadcast malicious or disruptive content under the guise of legitimate channel owners. An attacker who successfully predicts the stream key can push video streams directly to the live feed without needing credentials such as usernames or passwords associated with the account. This capability undermines the integrity of the streaming platform, enabling potential activities ranging from spamming and defamation to distributing malware via embedded links in the broadcast metadata. The impact is particularly severe for channels that rely on real-time interaction or monetization through legitimate content delivery, as their reputation and audience trust can be instantly compromised by unauthorized broadcasts.
This vulnerability aligns with CWE-330: Use of Insufficiently Random Values, which describes flaws where random values are not sufficiently unpredictable to prevent prediction attacks. Furthermore, it relates to CWE-798: Use of Hard-coded Credentials if the predictable keys effectively act as static secrets that can be derived without proper authentication mechanisms. In terms of offensive security frameworks, this scenario maps to MITRE ATT&CK technique T1078: Valid Accounts, where attackers use legitimate credentials or credential-like artifacts (in this case, predicted stream keys) to gain access and perform actions within the system. The lack of cryptographic randomness in token generation is a common pitfall in web application development that often leads to severe authentication bypasses.
To mitigate this vulnerability, developers must replace the usage of uniqid() with cryptographically secure random number generators provided by modern programming languages or libraries. For PHP applications, functions such as bin2hex(random_bytes()) or openssl_random_pseudo_bytes should be employed to generate stream keys and other security tokens. These methods draw entropy from the operating system's CSPRNG, ensuring that generated values are unpredictable even if the exact time of generation is known by an adversary. Additionally, implementing rate limiting on RTMP publish requests can provide a secondary layer of defense, slowing down brute-force attempts even if key prediction becomes partially feasible. Regular security audits focusing on authentication token generation practices and adherence to OWASP guidelines for session management and cryptographic storage are essential to prevent similar issues in the future.