CVE-2026-86721 | BDVDB-2026-370458 Detail

Description#

AVideo through commit c3edcc274c contains an authorization bypass vulnerability where a session cookie named 'key' with value 'value' overrides the $_REQUEST['key'] parameter in saveLive.php and related endpoints. Attackers can publish to any user's RTMP stream without authentication by using the known constant stream key value to hijack live broadcasts.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-09-08Record published in the CVE List.
2. Version 22026-09-19Most recent update recorded in the CVE List.