CVE-2026-84187

Name of the Vulnerable Software and Affected Versions AVideo (affected versions not specified)

Description A missing authentication flaw exists in the plugin/Live/on publish.php file. Unauthenticated attackers can mark arbitrary scheduled broadcasts as failed by sending crafted POST requests to the unguarded RTMP callback endpoint. By providing fabricated stream keys following the pattern -ps-<N>, an attacker can modify scheduled broadcast status fields and silently cancel live broadcasts without requiring credentials or authorization.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.