CVE-2026-126541

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 29.7.2

Description A missing authorization issue exists in the Live plugin restream endpoints. Authenticated streamers can obtain stream keys of other users by providing arbitrary live transmitions history id values. Attackers can then use the issued action tokens at the 'verifyTokenForAction.json.php' endpoint to retrieve HLS (HTTP Live Streaming) URLs and stream keys, enabling them to publish content as the victim or restream private and pay-per-view live streams.

Recommendations Update AVideo to version 29.7.2 or later.