CVE-2026-89252: AVideo Missing Authorization in addLiveLink.php LiveLink Update
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to verify ownership in addLiveLink.php when updating LiveLinks, allowing authenticated users to modify other users' links. A canStream user can overwrite another user's LiveLink HLS source and metadata by supplying an existing linkId, redirecting viewers to attacker-controlled media.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated AVideo user with the canStream permission can exploit the issue. The attacker needs the linkId of an existing LiveLink belonging to another user.
What can an attacker change?
The attacker can overwrite another user's LiveLink HLS source and metadata. This can redirect viewers of the affected link to attacker-controlled media.
Is unauthenticated exploitation possible?
No. Exploitation requires an authenticated account with canStream permission.
How can administrators identify potentially affected LiveLinks?
Review LiveLink updates for cases where the account performing an update does not own the updated linkId. Investigate links whose HLS source or metadata unexpectedly points to unapproved media.