CVE-2026-85162: AVideo through c91b5975d CSRF via saveLive.php
AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in plugin/Live/saveLive.php that lacks forbidIfNotPost and forbidIfInvalidToken protections. Attackers can craft malicious image tags to overwrite authenticated streamers' RTMP keys, passwords, and titles, hijacking live broadcasts.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Authenticated AVideo streamers are exposed because the affected endpoint can overwrite their RTMP keys, passwords, and stream titles. An attacker does not need an account or prior privileges.
What does an attacker need to exploit it?
The attacker needs to induce an authenticated streamer to load attacker-controlled content, such as a malicious image tag. Successful exploitation relies on the victim having an active authenticated session.
What can be done if an update is not immediately available?
Avoid opening untrusted pages or content while logged in as an AVideo streamer, since exploitation requires user interaction in an authenticated browser session. Rotate RTMP keys and passwords if unauthorized changes are suspected.
How can administrators identify possible exploitation?
Review live-stream configuration for unexpected changes to RTMP keys, passwords, or titles. These fields are the stated targets of the vulnerable saveLive.php endpoint.