CVE-2026-86720: WWBN AVideo Missing Authorization via resendRestreamer.json.php
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate ownership of liverestreamsid in resendRestreamer.json.php, allowing authenticated users with canStream to access other users' restream destinations. Attackers can broadcast their live stream to victim-configured restream destinations by supplying arbitrary liverestreamsid values, hijacking YouTube, Facebook, or Twitch streams using victim stream keys.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch c3edcc274c389816d434acadac07ee78eaf330c1
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated AVideo user who has the canStream permission can exploit it. The attacker does not need to own the targeted restream configuration.
What access does exploitation provide?
An attacker can access another user's configured restream destinations and broadcast their own live stream to them. This can hijack streams on destinations such as YouTube, Facebook, or Twitch by using the victim's stream keys.
What identifier does an attacker need to manipulate?
The attacker supplies arbitrary live_restreams_id values to resendRestreamer.json.php. The affected endpoint does not validate that the requester owns the referenced restream configuration.
How can administrators determine whether their deployment is affected?
Deployments are affected if they include the described behavior through commit c3edcc274c389816d434acadac07ee78eaf330c1. Review resendRestreamer.json.php to determine whether it verifies ownership of live_restreams_id before using a restream destination.