CVE-2026-88874: AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 Authentication Bypass
AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) does not enforce the Live stream password check on the stats endpoint or on the HLS origin. Live::getStats() (plugin/Live/Live.php) returns a password-protected transmission's RTMP stream key, its isPasswordProtected flag, and its HLS (m3u8) URL to unauthenticated callers, in both the public applications list and the hiddenapplications branch used when canSeeLiveFromLiveKey() fails. Separately, the shipped NGINX configuration (deploy/nginx/nginx.conf) serves the .m3u8 playlist, the AES-128 key, and the transport-stream segments from the /live location without any authrequest (the authkeycheck directive in the .key location is commented out). A remote, unauthenticated attacker can therefore retrieve the stream key and decryption key and watch a password-protected live transmission without supplying the configured password. No patched version was available at the time of the advisory.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Fix the shipped NGINX configuration so the /live location for HLS assets (serve .m3u8 playlist, AES-128 key, and transport-stream segments) performs authentication; specifically ensure auth_request is enforced by uncommenting/enabling the auth_key_check directive in the .key location that is currently commented out in deploy/nginx/nginx.conf.
- Compensating control
Restrict access to the Live stream stats endpoint and the HLS origin endpoints so unauthenticated callers cannot retrieve Live::_getStats() outputs for password-protected transmissions (RTMP stream key, isPasswordProtected flag, and HLS m3u8 URL).
Event History
Frequently Asked Questions
Who is exposed to this issue?
AVideo deployments through revision c3edcc274c389816d434acadac07ee78eaf330c1 are exposed where password-protected live transmissions are available. The issue affects both unauthenticated access to live-stream statistics and the shipped NGINX configuration serving HLS content.
What does an attacker need to exploit it?
An attacker only needs remote network access to the affected AVideo service; no account, configured live-stream password, or user interaction is required. They can obtain the RTMP stream key, HLS playlist URL, and AES-128 decryption key needed to watch a protected stream.
Are password-protected live streams protected by the default NGINX configuration?
No. The shipped NGINX configuration serves the HLS playlist, encryption key, and transport-stream segments from /live without an auth_request; the auth_key_check directive for the key location is commented out.
How can I tell whether my instance is affected?
An instance is affected if it is running AVideo at or before the identified revision and unauthenticated requests can retrieve data from the Live stats endpoint or access protected stream HLS resources under /live. The affected behavior includes returning stream keys and HLS URLs even through the hidden_applications path.
Is a patched version available?
No patched version was available at the time of the advisory.