CVE-2026-86720

WWBN AVideo, through commit c3edcc274c389816d434acadac07ee78eaf330c1, does not verify that the live_restreams_id value supplied to resendRestreamer.json.php belongs to the requesting user, an authorization bypass via user-controlled key (CWE-639). Any authenticated account holding the canStream privilege can therefore submit an arbitrary live_restreams_id and access restream destinations configured by other users on the same server. By supplying a victim's live_restreams_id, an attacker can broadcast their own live stream to the victim's configured restream targets on YouTube, Facebook, or Twitch using the victim's stored stream keys, effectively hijacking or preempting those channels' live output. The affected population is any AVideo deployment with multiple canStream users, especially internet-exposed multi-user instances. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known as of this analysis, and EPSS puts the 30-day exploitation probability at 0.3%.

What to do: Update AVideo to a revision later than commit c3edcc274c389816d434acadac07ee78eaf330c1 once a patched release is published, as no fixed version is named in the available data. As an interim mitigation, limit canStream accounts to trusted users, enforce an ownership check on live_restreams_id in resendRestreamer.json.php, and restrict access to that endpoint. Monitor configured YouTube, Facebook, and Twitch destinations for unauthorized broadcasts and rotate stream keys if hijacking is suspected.