Executive brief
AVideo is a live streaming platform that allows users to broadcast and manage restreams to multiple destinations like YouTube and Twitch. A flaw in the getRestream.json.php endpoint fails to verify restream ownership, allowing any authenticated user with streaming permission to obtain other users' stream keys and credentials. An attacker can use these credentials to publish content to victims' streaming accounts without authorization.
Technical details
The vulnerability is a missing authorization check (CWE-862, CWE-639) in plugin/Live/view/getRestream.json.php:22-40. After verifying only that a user has canStream permission, the endpoint accepts a restreams_id parameter without validating that the requesting user owns that restream—a check present in sibling endpoints getAction.json.php and getLogContent.json.php. An attacker mints a tokenForAction for any restream, exchanges it via verifyTokenForAction.json.php, and then passes the resulting token to getLiveKey.json.php, which bypasses ownership validation when a token is present. This permits unauthenticated reading of stream keys (YouTube, Twitch, RTMP credentials). Attack requires network access and a low-privilege authenticated account with canStream permission; no user interaction is needed. No patch was available at time of reporting.
Affected products
- WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1
Timeline
- 2026-08-27: disclosed
- 2026-09-10: advisory: CVE-2026-88865 published