CVE-2026-34374: AVideo has SQL Injection in Live_schedule::keyExists() via Unparameterized Stream Key
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the Liveschedule::keyExists() method constructs a SQL query by interpolating a stream key directly into the query string without parameterization. This method is called as a fallback from LiveTransmition::keyExists() when the initial parameterized lookup returns no results. Although the calling function correctly uses parameterized queries for its own lookup, the fallback path to Liveschedule::keyExists() undoes this protection entirely. This vulnerability is distinct from GHSA-pvw4-p2jm-chjm, which covers SQL injection via the livescheduleid parameter in the reminder function. This finding targets the stream key lookup path used during RTMP publish authentication. As of time of publication, no patched versions are available.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34374?
CVE-2026-34374 has been classified as a high-severity SQL Injection vulnerability.
How do I fix CVE-2026-34374?
To fix CVE-2026-34374, update AVideo to version 26.1 or later, which properly parameterizes SQL queries.
What software is affected by CVE-2026-34374?
CVE-2026-34374 affects WWBN AVideo versions up to and including 26.0.
What type of vulnerability is CVE-2026-34374?
CVE-2026-34374 is an SQL Injection vulnerability that allows attackers to execute arbitrary SQL queries.
What is the impact of exploiting CVE-2026-34374?
Exploiting CVE-2026-34374 can lead to unauthorized access to the database and potential data loss or corruption.