CVE-2026-82645

AVideo, in commit e01e41ecc and all earlier versions, exposes third-party stream credentials through the plugin/Live/view/Live_restreams/getLiveKey.json.php endpoint without authentication. An attacker can supply a 'token' parameter that waives both the Live::canRestream() access gate and the restream ownership check, and because the token is merely an AES-256-CBC encryption of an integer id (deterministic IV, no MAC, no user binding), valid tokens can be forged using the public encryption oracle in view/url2Embed.json.php. This lets any unauthenticated remote attacker retrieve the stream_key and stream_url of any user's restreams, i.e., credentials for external platforms such as YouTube, Facebook, and Twitch, which could enable stream hijacking or platform impersonation. Any unpatched AVideo deployment exposing these endpoints is affected. No exploitation has been observed: EPSS is 0.1%, the flaw is not in CISA KEV, and no public proof-of-concept is known.

What to do: Update AVideo to a build later than commit e01e41ecc as soon as a patched release is available. As an interim mitigation, restrict unauthenticated web access to plugin/Live/view/Live_restreams/getLiveKey.json.php and view/url2Embed.json.php (e.g., via access rules or WAF) and review access logs for unauthenticated requests carrying a 'token' parameter to either endpoint. If compromise is suspected, rotate the affected accounts' stream keys on YouTube, Facebook, and Twitch.