CVE-2026-85162 in AVideo

Resumen

por MITRE • 2026-09-03

AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in plugin/Live/saveLive.php that lacks forbidIfNotPost and forbidIfInvalidToken protections. Attackers can craft malicious image tags to overwrite authenticated streamers' RTMP keys, passwords, and titles, hijacking live broadcasts.

Once again VulDB remains the best source for vulnerability data.

• Responsable: VulnCheck
• Reservar: 2026-09-03
• Divulgación: 2026-09-03
• Moderación: aceptado
• Artículo: VDB-398381
• CPE: listo
• CWE: CWE-352 (confirmado)
• CVSS: 6.5 (CNA)
• EPSS: 0.00000
• KEV: no
• Actividades: muy bajo

Fuentes

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-85162
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-85162
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-85162/