Is CVE-2026-92912 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-92912 being exploited in the wild.

How severe is CVE-2026-92912?

Medium severity, with a CVSS score of 6.5, published 17 September 2026.

Which products and versions are affected?

WWBN AVideo through c3edcc274c389816d434acadac07ee78eaf330c1.

Is there a fix for CVE-2026-92912?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-92912 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-92912?

Check whether you run WWBN AVideo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-92912: AVideo weak cryptographic PRNG for RTMP publish keys

CVE-2026-92912 · Severity: medium · CVSS 6.5 · Published 2026-09-17

AVideo is a live streaming platform where broadcasters create channels with cryptographic keys that authorize stream publication. The platform generates these authorization keys using a weak algorithm based only on the creation timestamp, resulting in roughly one million guessable combinations per second. An attacker who knows when a channel was created can brute-force the stream key and broadcast fraudulent content under the channel owner's identity.

Technologies: WWBN AVideo. Vendors: WWBN.

Quick answers

Is CVE-2026-92912 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-92912 being exploited in the wild.
How severe is CVE-2026-92912?: Medium severity, with a CVSS score of 6.5, published 17 September 2026.
Which products and versions are affected?: WWBN AVideo through c3edcc274c389816d434acadac07ee78eaf330c1.
Is there a fix for CVE-2026-92912?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-92912 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-92912?: Check whether you run WWBN AVideo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an insufficient randomness issue (CWE-330/CWE-340) in the LiveTransmition class methods createTransmitionIfNeed() and resetTransmitionKey(), which generate RTMP stream authorization keys using PHP's uniqid() function. The uniqid() output is deterministic, containing only the creation second (8 hex digits) and microseconds (5 hex digits), providing a key space of approximately 1 million possibilities per second. An attacker with knowledge of the channel creation timestamp can brute-force the microsecond component without requiring authentication or user interaction, allowing unauthorized broadcast capability. The attack requires either out-of-band key disclosure via other means (e.g., prior advisory GHSA-306/522) or RTMP-level probing to validate candidates. No patch has been released as of the advisory date; the suggested fix is to use random_bytes(16) with bin2hex() encoding instead.

Affected products

WWBN AVideo through c3edcc274c389816d434acadac07ee78eaf330c1

Timeline

2026-09-02: disclosed: GitHub Security Advisory GHSA-h983-2mcw-672j published
2026-09-17: advisory: Public advisory and NVD entry CVE-2026-92912

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.