CVE-2026-92912: AVideo Cryptographically Weak PRNG via uniqid Stream Key
AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 uses cryptographically weak uniqid() values for RTMP publish keys in LiveTransmition, reducing key entropy to approximately one million possibilities per creation second. Attackers who know the channel creation time can brute-force the five-digit microsecond component to forge valid stream keys and broadcast content as the channel owner.
Affected Software
Event History
Frequently Asked Questions
What information does an attacker need to exploit this issue?
The attacker needs to know the channel creation time. That knowledge lets them brute-force the approximately one million possible microsecond-derived values used in a publish key created during that second.
What could an attacker do with a forged publish key?
An attacker could publish RTMP content as the channel owner. The provided impact data indicates limited confidentiality impact and high integrity impact, with no availability impact.
Does exploitation require authentication or user interaction?
No. The supplied vector indicates network reachability, no privileges required, and no user interaction, although exploitation has high attack complexity because the attacker must know the relevant channel creation time and brute-force the key space.