CVE-2026-88874

AVideo through master revision c3edcc274c389816d434acadac07ee78eaf330c1 (2026-08-23) fails to enforce the configured password on live streams at the Live stats endpoint and the HLS origin, an information-exposure/authentication bypass flaw (CWE-200). The Live::_getStats() routine (plugin/Live/Live.php) returns a password-protected transmission's RTMP stream key, its isPasswordProtected flag, and its HLS (m3u8) URL to unauthenticated callers in both the public applications list and the hidden_applications branch used when canSeeLiveFromLiveKey() fails, and the shipped NGINX configuration (deploy/nginx/nginx.conf) serves the .m3u8 playlist, the AES-128 decryption key, and transport-stream segments from the /live location without any auth_request (the auth_key_check directive in the .key location is commented out). A remote, unauthenticated attacker can therefore retrieve the stream key and decryption key and watch a password-protected live transmission without ever supplying the configured password. Any AVideo deployment using password-protected live streams with the affected revision and stock NGINX configuration is affected; confidentiality only, scored 8.7 (High) under CVSS 4.0. No public proof-of-concept, in-the-wild exploitation, or KEV listing is known, and no patched version was available at the time of the advisory.

What to do: No patched release was available at advisory time, so apply workarounds: add auth_request enforcement to the /live location in deploy/nginx/nginx.conf and enable the commented-out auth_key_check directive for the AES-128 .key location, and restrict the Live stats endpoint so _getStats() does not expose stream keys and m3u8 URLs to unauthenticated callers. Administrators should check whether any live streams are configured with passwords and internet-exposed, treat leaked RTMP stream keys as compromised and rotate them, and monitor the upstream repository for an official patch.