CVE-2026-86721: AVideo through c3edcc274c Authorization Bypass via Session Cookie
AVideo through commit c3edcc274c contains an authorization bypass vulnerability where a session cookie named 'key' with value 'value' overrides the $REQUEST['key'] parameter in saveLive.php and related endpoints. Attackers can publish to any user's RTMP stream without authentication by using the known constant stream key value to hijack live broadcasts.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker needs only network access to a vulnerable AVideo instance. No authentication or user interaction is required; they can use a session cookie named "key" with the value "value" as the stream key.
What systems or users are exposed?
AVideo instances that include the affected behavior in saveLive.php or related endpoints are exposed. Any user's RTMP stream may be targeted, allowing an unauthenticated attacker to publish content to and hijack live broadcasts.
How can I tell whether an instance is affected?
Review the deployed AVideo code for the behavior described through commit c3edcc274c: a session cookie named "key" with value "value" overriding the $_REQUEST['key'] parameter in saveLive.php or related endpoints. An instance exhibiting that override is affected.