CVE-2026-61569

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 8.1.0

Description An unauthenticated streamer login process allows for SQL injection. The endpoint objects/login.json.php passes the user parameter to the Streamer::get() function in objects/Streamer.php, which is then interpolated into a MariaDB SELECT query without proper parameterization or escaping. While literal single quotes are stripped, the html entity decode function in objects/Login.php restores entity-encoded quotes before the query is executed. An attacker can use this to read arbitrary encoder database data, such as stored upstream streamer credentials, allowlist configurations, and queue records. The impact is limited to data reads because stacked statements are not permitted by the mysqli driver and the database account lacks global FILE privileges.

Recommendations Update to version 8.1.0. As a temporary workaround, restrict access to the objects/login.json.php endpoint.