# CVE-2026-61569: AVideo Encoder SQL injection in streamer login

Source: https://junglewise.ai/threats/cve-2026-61569-avideo-is-a-video-sharing-platform-prior-to-8-1-0-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-28. Updated: 2026-10-28  
License: CC BY 4.0 with a link back

CVE-2026-61569 · Severity: high · CVSS 7.5 · Published 2026-10-28

AVideo Encoder is a video platform that handles video encoding and streaming. An attacker without credentials can extract sensitive database information, including stored encoder credentials and configuration, by exploiting an SQL injection vulnerability in the streamer login endpoint. This allows unauthorized data exfiltration and potential credential theft for continued unauthorized access.

Technologies: [WWBN AVideo Encoder](https://junglewise.ai/threats/technologies/avideo-encoder). Vendors: [WWBN](https://junglewise.ai/threats/vendors/wwbn).

## Quick answers

**Is CVE-2026-61569 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-61569 being exploited in the wild.

**How severe is CVE-2026-61569?** High severity, with a CVSS score of 7.5, published 28 October 2026.

**Which products and versions are affected?** WWBN AVideo Encoder prior to 8.1.0.

**Is there a fix for CVE-2026-61569?** Yes: fixed in 8.1.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-61569 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-61569?** Check whether you run WWBN AVideo Encoder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 8.1.0

## Technical details

The vulnerability is a SQL injection in the `Streamer::get` function within `objects/Streamer.php`, where the `user` parameter from the unauthenticated `/objects/login.json.php` endpoint is interpolated directly into a SELECT query without parameterization. Although single quotes are stripped by `security.php`, HTML entity decoding in `Login.php` restores them before query execution. An attacker can inject UNION-based SQL queries to read arbitrary database data; results are exposed via the `streamers_id` response field or query error messages. Successful exploitation requires bypassing the streamer allowlist (which is empty by default, allowing all sites) and having the login response set `canUpload` or `isAdmin`.

## Affected products

- WWBN AVideo Encoder prior to 8.1.0

## Timeline

- 2026-10-28: disclosed

## References

- [https://github.com/WWBN/AVideo-Encoder/commit/8a6e2b8aedb87702656636d3fc8d9e26e559a762](https://github.com/WWBN/AVideo-Encoder/commit/8a6e2b8aedb87702656636d3fc8d9e26e559a762)
- [https://github.com/WWBN/AVideo-Encoder/releases/tag/v8.1.0](https://github.com/WWBN/AVideo-Encoder/releases/tag/v8.1.0)

## Related threats

- [AVideo stored cross-site scripting in encoder queue title](https://junglewise.ai/threats/cve-2026-61575-avideo-is-a-video-sharing-platform-prior-to-8-1-0-view-queue-php)
- [AVideo Encoder authentication bypass in control endpoints](https://junglewise.ai/threats/cve-2026-61571-avideo-is-a-video-sharing-platform-prior-to-8-1-0-the-encoder)
- [AVideo remote code execution in live-streaming endpoint](https://junglewise.ai/threats/cve-2026-61567-avideo-is-a-video-sharing-platform-prior-to-8-1-0-the-live)