CVE-2026-61569: AVideo-Encoder: pre-authentication streamer-login SQL injection
AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated streamer login at objects/login.json.php passes the user parameter to Streamer::get in objects/Streamer.php, where it is interpolated into a single-quoted MariaDB SELECT without parameterization or escaping. Although objects/security.php strips literal single quotes, htmlentitydecode in objects/Login.php restores entity-encoded quotes before the query. The supplied siteURL must pass the streamer allowlist, which allows all sites when empty by default, and an attacker-hosted login response must set canUpload or isAdmin to reach Streamer::createIfNotExists. That function calls Streamer::get before its additional allowlist check. UNION results are exposed through streamersid, while failures return the rendered query and MariaDB error. An attacker can read arbitrary encoder database data, including stored upstream streamer credentials, allowlist configuration, and queue records, without encoder credentials. Stacked statements are not permitted by the mysqli driver and the tested database account lacks global FILE privilege, so the demonstrated vector is bounded to reads rather than server-side file writes. Stolen streamer credentials can provide continued upstream access until rotated. This issue is fixed in version 8.1.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AVideo-Encoderto a version that resolves this vulnerability.Fixed in 8.1.0 - Operational
Rotate stolen streamer credentials, which can provide continued upstream access until rotated.
Event History
Frequently Asked Questions
Which deployments are exposed by default?
Encoder deployments prior to 8.1.0 are exposed when the streamer site allowlist is empty, because an empty allowlist permits all sites by default. The vulnerable login endpoint is unauthenticated, so encoder credentials are not required.
What does an attacker need to exploit this issue?
An attacker needs to submit a crafted user value to the unauthenticated streamer login and provide a siteURL that passes the streamer allowlist. They also need an attacker-hosted login response that sets canUpload or isAdmin so execution reaches Streamer::createIfNotExists.
What data can be accessed?
The demonstrated vector permits reading arbitrary encoder database data through UNION results exposed in streamers_id. This can include stored upstream streamer credentials, allowlist configuration, and queue records; query failures may also disclose the rendered SQL query and MariaDB error.
What are the known limits of the demonstrated attack?
Stacked SQL statements are not permitted by the mysqli driver. The tested database account also lacked global FILE privilege, so the demonstrated vector was bounded to database reads rather than the capabilities that would require those features.
What should be done if upgrading is not immediately possible?
Populate the streamer site allowlist rather than leaving it empty, limiting accepted siteURL values. This does not replace upgrading to 8.1.0 or later, which is the version identified as no longer affected.