Executive brief
AVideo is a live streaming platform where broadcasters create channels with cryptographic keys that authorize stream publication. The platform generates these authorization keys using a weak algorithm based only on the creation timestamp, resulting in roughly one million guessable combinations per second. An attacker who knows when a channel was created can brute-force the stream key and broadcast fraudulent content under the channel owner's identity.
Technical details
The vulnerability is an insufficient randomness issue (CWE-330/CWE-340) in the LiveTransmition class methods createTransmitionIfNeed() and resetTransmitionKey(), which generate RTMP stream authorization keys using PHP's uniqid() function. The uniqid() output is deterministic, containing only the creation second (8 hex digits) and microseconds (5 hex digits), providing a key space of approximately 1 million possibilities per second. An attacker with knowledge of the channel creation timestamp can brute-force the microsecond component without requiring authentication or user interaction, allowing unauthorized broadcast capability. The attack requires either out-of-band key disclosure via other means (e.g., prior advisory GHSA-306/522) or RTMP-level probing to validate candidates. No patch has been released as of the advisory date; the suggested fix is to use random_bytes(16) with bin2hex() encoding instead.
Affected products
- WWBN AVideo through c3edcc274c389816d434acadac07ee78eaf330c1
Timeline
- 2026-09-02: disclosed: GitHub Security Advisory GHSA-h983-2mcw-672j published
- 2026-09-17: advisory: Public advisory and NVD entry CVE-2026-92912