CVE-2026-82645: AVideo Unauthenticated Stream Credential Disclosure via Forgeable Token
AVideo (current commit e01e41ecc and earlier) exposes stream credentials through the plugin/Live/view/Liverestreams/getLiveKey.json.php endpoint. Supplying a 'token' request parameter waives both the Live::canRestream() access gate and the restream ownership check, causing the endpoint to return any restream's streamkey and streamurl (credentials for external platforms such as YouTube, Facebook, and Twitch) without authentication. The token is merely encryptString() of an integer id with no user binding, expiry, or authentication tag. Because encryption uses AES-256-CBC with a deterministic IV and no MAC, and because intval() accepts any string beginning with a digit, an unauthenticated attacker can forge valid tokens using the public encryption oracle in view/url2Embed.json.php, disclosing arbitrary users' stream credentials.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
AVideo deployments at commit e01e41ecc or earlier are affected if the Live plugin endpoint plugin/Live/view/Live_restreams/getLiveKey.json.php is reachable. No authentication or existing user privileges are required by the attacker.
What does an attacker need to exploit it?
An attacker can use the public encryption oracle at view/url2Embed.json.php to forge a token for an integer restream ID. The forged token bypasses the restream permission and ownership checks, allowing retrieval of arbitrary restream stream_key and stream_url values.
What information can be exposed?
The affected endpoint can return stream credentials for external streaming platforms, including YouTube, Facebook, and Twitch. The disclosure is limited in the provided information to stream_key and stream_url data; integrity and availability impacts are not described.
How can I determine whether my deployment is affected?
Check whether the AVideo instance is at commit e01e41ecc or earlier and whether the Live plugin exposes the getLiveKey.json.php endpoint. Affected behavior exists when supplying a token parameter causes the endpoint to return restream credentials without an authenticated session or authorization for that restream.