CVE-2026-88865

AVideo, through commit c3edcc274c389816d434acadac07ee78eaf330c1, fails to validate restream ownership in getRestream.json.php, an authorization bypass tracked as CWE-639. An authenticated user holding the canStream permission can request tokens for restreams owned by other users and exchange those tokens through getLiveKey.json.php. The attacker thereby retrieves other users' live stream keys and can publish video to those users' configured YouTube, Twitch, or RTMP destinations. Any AVideo deployment running affected code where canStream is granted to accounts beyond the stream key owners is exposed, with impact on confidentiality and integrity of streaming destinations but not availability. No public proof-of-concept or confirmed in-the-wild exploitation is known; the issue is not listed in CISA's KEV and is rated 8.6 High under CVSS 4.0.

What to do: Update AVideo to code newer than commit c3edcc274c389816d434acadac07ee78eaf330c1, which includes restream ownership validation in getRestream.json.php. As an interim mitigation, restrict the canStream permission to trusted accounts and audit which users currently hold it. On multi-user instances, rotate YouTube, Twitch, and RTMP stream keys in case keys were retrieved without authorization.