CVE-2026-84187

AVideo, a self-hosted open-source video streaming platform, fails to authenticate requests to the RTMP publish callback endpoint at plugin/Live/on_publish.php, allowing any unauthenticated attacker to send crafted POST requests containing schedule identifiers. Because the endpoint accepts stream keys matching the pattern -ps-<N> without verifying them against a legitimate publisher, an attacker can modify scheduled broadcast status fields and mark arbitrary scheduled broadcasts as failed. The practical impact is the silent cancellation of scheduled live broadcasts without any credentials or authorization, which drives the high availability impact reflected in the 8.8 (High) CVSS 4.0 score. Any AVideo deployment with the Live plugin enabled and the on_publish.php callback reachable — particularly internet-exposed instances — is affected. No exploitation has been observed: there is no public proof-of-concept, the flaw is not in CISA KEV, and EPSS estimates only a 0.3% chance of exploitation within 30 days.

What to do: Restrict access to plugin/Live/on_publish.php to trusted RTMP server addresses (e.g., via firewall allowlists) or add authentication and strict stream-key verification, since no patched version is specified in the available data. Review logs for unauthenticated POSTs to that endpoint and for scheduled broadcasts unexpectedly marked as failed. Monitor the AVideo project for an official fix and apply it as soon as it is released.