Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.2

AVideo reveals live stream passwords without login

CVE-2026-82645 · published 4 days ago
Summary

The AVideo video platform can return the passwords and URLs used to broadcast to services like YouTube, Facebook, and Twitch even to people who are not logged in. An attacker can create a fake token and ask the system for any user's streaming credentials, letting them hijack or copy the live streams. Update AVideo to the latest version or apply the provided patch, and restrict access to the endpoint to trusted users only.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
wwbn avideo All versions
Original advisory text
AVideo Unauthenticated Stream Credential Disclosure via Forgeable Token
AVideo (current commit e01e41ecc and earlier) exposes stream credentials through the plugin/Live/view/Live_restreams/getLiveKey.json.php endpoint. Supplying a 'token' request parameter waives both the Live::canRestream() access gate and the restream ownership check, causing the endpoint to return any restream's stream_key and stream_url (credentials for external platforms such as YouTube, Facebook, and Twitch) without authentication. The token is merely encryptString() of an integer id with no user binding, expiry, or authentication tag. Because encryption uses AES-256-CBC with a deterministic IV and no MAC, and because intval() accepts any string beginning with a digit, an unauthenticated attacker can forge valid tokens using the public encryption oracle in view/url2Embed.json.php, disclosing arbitrary users' stream credentials.
References
Severity
9.2 Critical
CVSS 3.1: 8.6 (MITRE)
Exploitation
EPSS <1%
Type
CWE-347Improper Verification of Cryptographic Signature
Timeline
Published30 Aug 2026
Updated2 Sep 2026
First seen30 Aug 2026
Sources
CVE-2026-82645 · NVD
CVE-2026-82645 · MITRE
Monitor software like this
Free during beta