CVE-2026-86721

AVideo, an open-source self-hosted video streaming platform, contains an authorization bypass (CWE-287) in saveLive.php and related endpoints: a session cookie named 'key' set to the constant value 'value' overrides the $_REQUEST['key'] parameter that normally carries the publisher's stream key. An unauthenticated remote attacker can therefore send this known cookie value to satisfy the stream-key check and publish video to any user's RTMP live stream, effectively hijacking live broadcasts without valid credentials. The impact is an unauthenticated, high-integrity modification of live stream content (CVSS 4.0 score 8.7), with no direct confidentiality or availability impact. Any AVideo deployment at or before commit c3edcc274c that exposes the live publishing endpoints is affected. No public proof-of-concept, in-the-wild exploitation, or KEV listing is known, and EPSS currently estimates about a 0.3% chance of exploitation within 30 days.

What to do: Update AVideo to a revision newer than commit c3edcc274c or apply the maintainer's fix for saveLive.php and related endpoints; no fixed version number is specified in this data, so check the project's repository for the latest release. Until patched, restrict public access to saveLive.php and related endpoints and rotate any default or static RTMP stream keys. Monitor live streams for unauthorized publishes, as the flaw is trivially reproducible from the published details even though no public PoC exists yet.