PT-2026-89376

CVE-2026-88865

Published

2026-09-10

Updated

2026-09-18

Description by

CVSS 4.0

8.6

High

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions AVideo versions prior to commit c3edcc274c389816d434acadac07ee78eaf330c1

Description Authenticated users with canStream permission can mint tokens for arbitrary restreams because the software fails to validate restream ownership in the 'getRestream.json.php' endpoint. These tokens can be exchanged via the 'getLiveKey.json.php' endpoint to retrieve stream keys belonging to other users, enabling unauthorized publishing to YouTube, Twitch, or RTMP destinations.

Recommendations Update AVideo to the version containing commit c3edcc274c389816d434acadac07ee78eaf330c1.

Exploitability

Exploit

Fix

Impacts

Researchers

Santhreal

Vendors

Affected products

Weakness enumeration

CWE-639: Authorization Bypass Through User-Controlled Key

Related identifiers