CVE-2026-89252

CVE-2026-89252 is an authorization bypass (CWE-639) in AVideo's addLiveLink.php endpoint, which fails to verify that a LiveLink belongs to the user modifying it. An authenticated user with the canStream role can supply another user's existing linkId and overwrite that LiveLink's HLS source URL and metadata. This lets the attacker silently redirect the victim's stream viewers to attacker-controlled media without any confidentiality or availability impact. Any AVideo deployment up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1 that grants canStream access to multiple users is affected. No public proof-of-concept is known, the issue is not in CISA's KEV, and no exploitation in the wild has been reported.

What to do: Upgrade AVideo to a version newer than commit c3edcc274c389816d434acadac07ee78eaf330c1 once a patched release is published, or apply the upstream ownership-validation fix for addLiveLink.php. Restrict canStream accounts to trusted operators and audit existing LiveLinks for unexpected HLS source URLs or metadata changes. No fixed version number is specified in the disclosure, so monitor the vendor for a patched release.