Executive brief
AVideo is a video streaming platform that allows content creators to broadcast live streams. A cross-site request forgery (CSRF) vulnerability in the live stream configuration endpoint allows attackers to hijack authenticated streamers' broadcasts by overwriting their RTMP keys, passwords, and stream titles through malicious web pages. An attacker could redirect viewer traffic to their own stream infrastructure, effectively seizing control of a broadcaster's live audience.
Technical details
The vulnerability is a cross-site request forgery (CWE-352) in plugin/Live/saveLive.php, which lacks forbidIfNotPost() and forbidIfInvalidToken() protections. The endpoint reads stream configuration parameters (title, key, password) from $_REQUEST, which accepts both GET and POST, and performs only an authentication check via User::canStream() without CSRF token validation. An attacker can craft a malicious <img> tag pointing to saveLive.php with crafted query parameters; when an authenticated streamer visits a page containing this tag, their browser automatically sends their session cookie, allowing the attacker to modify the victim's RTMP key and hijack the broadcast. The vulnerability requires the victim to be logged in with streaming permission and to visit the attacker-controlled page. No patch is currently available.
Affected products
- WWBN AVideo through commit c91b5975d
Timeline
- 2026-08-19: disclosed: GitHub Security Advisory GHSA-6jj8-2953-6frf published
- 2026-09-03: advisory: CVE-2026-85162 published on NVD