CVE-2026-82645

Name of the Vulnerable Software and Affected Versions AVideo versions prior to commit e01e41ecc

Description An issue exists where stream credentials for external platforms such as YouTube, Facebook, and Twitch are exposed. An unauthenticated attacker can bypass the Live::canRestream() access gate and the restream ownership check by providing a token request parameter to the 'plugin/Live/view/Live restreams/getLiveKey.json.php' endpoint. This allows the endpoint to return the stream key and stream url of any restream. The vulnerability is possible because the token is generated using encryptString() on an integer ID without user binding, expiry, or authentication tags. Since the encryption uses AES-256-CBC with a deterministic IV and no MAC, and intval() accepts any string starting with a digit, attackers can forge valid tokens using the public encryption oracle in 'view/url2Embed.json.php'.

Recommendations Update AVideo to a version beyond commit e01e41ecc. As a temporary mitigation, restrict access to the 'plugin/Live/view/Live restreams/getLiveKey.json.php' and 'view/url2Embed.json.php' endpoints.