CVE-2026-84187: AVideo on_publish.php Missing Authentication Check via RTMP Callback
AVideo contains a missing authentication vulnerability in plugin/Live/onpublish.php that allows unauthenticated attackers to mark arbitrary scheduled broadcasts as failed by sending crafted POST requests with schedule identifiers. Attackers can exploit the unguarded RTMP callback endpoint to modify scheduled broadcast status fields by supplying fabricated stream keys matching the pattern -ps-<N>, silently canceling any scheduled live broadcast without credentials or authorization.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
AVideo deployments that expose the plugin/Live/on_publish.php RTMP callback endpoint are affected. An unauthenticated remote attacker can send crafted POST requests to it.
What does an attacker need to exploit it?
No credentials or user interaction are required. The attacker needs a scheduled broadcast identifier and can provide a fabricated stream key matching the pattern -ps-<N>.
What is the practical impact of a successful exploit?
An attacker can alter scheduled broadcast status fields so that arbitrary scheduled live broadcasts are marked as failed. This silently cancels the targeted broadcasts.