CVE-2026-85162

AVideo through commit c91b5975d contains a cross-site request forgery (CSRF) flaw in its Live plugin, where plugin/Live/saveLive.php processes live-stream configuration changes without the standard forbidIfNotPost and forbidIfInvalidToken request-validity protections. The flaw is triggered when a logged-in streamer or administrator, while viewing attacker-controlled content, causes their browser to silently submit a forged request to saveLive.php — for example via a malicious image tag — which the server accepts because it relies solely on the victim's active session. The attacker can then overwrite the streamer's RTMP key, live password, and stream title, gaining the ability to hijack or take over the live broadcast on that AVideo instance. Any AVideo deployment at or before commit c91b5975d exposing the Live plugin is affected, and only authenticated streamers or administrators whose browsers load attacker-influenced pages can be targeted. There is currently no public proof of concept, no CISA KEV listing, and EPSS assigns only about a 0.1% probability of exploitation in the next 30 days, so exploitation has not been observed.

What to do: Upgrade AVideo to the latest release that includes fixes beyond commit c91b5975d and verify that plugin/Live/saveLive.php now enforces the forbidIfNotPost and forbidIfInvalidToken checks. Until patched, audit streamer RTMP keys, live passwords, and titles for unauthorized changes, restrict network access to saveLive.php where possible, and avoid browsing untrusted websites while logged in to an AVideo streamer or admin session.