Executive brief
AVideo is a video streaming platform that allows users to create and share live media links. A flaw in the LiveLinks feature fails to verify user ownership when updating links, allowing any authenticated user to hijack another user's live stream by redirecting it to attacker-controlled media. This could damage the victim's reputation and deceive viewers into watching unauthorized content under the victim's channel.
Technical details
The vulnerability is a missing authorization check (CWE-862, CWE-639) in plugin/LiveLinks/view/addLiveLink.php. When updating an existing LiveLink via the linkId parameter, the code only verifies that the user has canAddLinks permission but fails to check whether the user owns the link being modified. In contrast, the delete operation in delete_liveLink.json.php correctly compares the link owner (getUsers_id()) to the current user. An authenticated user with canStream privileges and when onlyAdminCanAddLinks=false can POST to addLiveLink.php with an existing linkId to overwrite the HLS source URL, title, description, status, and other metadata of links owned by other users. No user interaction or additional permissions are required beyond basic authentication.
Affected products
- WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1
Timeline
- 2026-08-27: disclosed: GitHub Security Advisory GHSA-m2c6-f5ww-j26v published
- 2026-09-11: advisory: CVE-2026-89252 published; NVD entry and VulnCheck advisory released