Executive brief
AVideo is a live streaming platform that allows users to broadcast video content using RTMP streams. A vulnerability in the session cookie handling causes all live stream authentication keys to be set to a hardcoded constant value, allowing attackers to hijack any user's live broadcast and replace their content with unauthorized streams.
Technical details
The vulnerability is an authentication bypass (CWE-287) in the session initialization code at objects/functionsPHP.php:592, which sets a session cookie named 'key' with the literal value 'value'. Due to PHP's variables_order=EGPCS configuration, $_COOKIE overrides $_GET and $_POST in the $_REQUEST superglobal. When plugin/Live/saveLive.php:33 calls $l->setKey($_REQUEST['key']), it always receives the constant string 'value' instead of the user-submitted key, and this override affects multiple endpoints including control.json.php, stopLive.php, and keyInfo.php. The RTMP stream key is the secret that authenticates publishers to the streaming server; because all stream keys are set to the known constant 'value', an unauthenticated attacker can publish to any user's stream. The vulnerability requires network access to the AVideo instance and knowledge of the constant key value (which is visible in source code), but no authentication or user interaction is needed to exploit it.
Affected products
- WWBN AVideo through commit c3edcc274c
Timeline
- 2026-08-24: disclosed
- 2026-09-08: advisory