PT-2026-87117 · Wwbn · Avideo

Santhreal

·

CVE-2026-86720

·

Publicado

2026-09-08

·

Atualizado

2026-09-08

CVSS v3.1

8.1

Alta

VetorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate ownership of live restreams id in resendRestreamer.json.php, allowing authenticated users with canStream to access other users' restream destinations. Attackers can broadcast their live stream to victim-configured restream destinations by supplying arbitrary live restreams id values, hijacking YouTube, Facebook, or Twitch streams using victim stream keys.

Exploit

Correção

IDOR

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2026-86720

Produtos afetados

Avideo