CVE-2026-82645
Received Received - Intake

AVideo Stream Credential Disclosure via Live Plugin

Publication date: 2026-08-30

Last updated on: 2026-08-30

Assigner: VulnCheck

Description
AVideo (current commit e01e41ecc and earlier) exposes stream credentials through the plugin/Live/view/Live_restreams/getLiveKey.json.php endpoint. Supplying a 'token' request parameter waives both the Live::canRestream() access gate and the restream ownership check, causing the endpoint to return any restream's stream_key and stream_url (credentials for external platforms such as YouTube, Facebook, and Twitch) without authentication. The token is merely encryptString() of an integer id with no user binding, expiry, or authentication tag. Because encryption uses AES-256-CBC with a deterministic IV and no MAC, and because intval() accepts any string beginning with a digit, an unauthenticated attacker can forge valid tokens using the public encryption oracle in view/url2Embed.json.php, disclosing arbitrary users' stream credentials.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-30
Last Modified
2026-08-30
Generated
2026-08-30
AI Q&A
2026-08-30
EPSS Evaluated
N/A
NVD
CVE-2026-82645
EUVD
EUVD-2026-68231

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
avideo avideo *
wwbn avideo to e01e41ecc (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-347 The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

AVideo versions up to commit e01e41ecc have a flaw in the Live_restreams/getLiveKey.json.php endpoint. An unauthenticated attacker can forge a token using a weak AES-256-CBC encryption method with a deterministic IV and no MAC. This token bypasses authentication and ownership checks, allowing retrieval of stream credentials (stream_key and stream_url) for external platforms like YouTube, Facebook, or Twitch.

Detection Guidance

Check if the vulnerable endpoint plugin/Live/view/Live_restreams/getLiveKey.json.php is accessible without authentication. Use curl to test the endpoint with a forged token parameter, e.g., curl -v 'http://target/plugin/Live/view/Live_restreams/getLiveKey.json.php?token=1'. If it returns stream credentials without authentication, the system is vulnerable.

Impact Analysis

An attacker can gain access to your streaming credentials, allowing them to broadcast under your identity on platforms like YouTube or Twitch. This could lead to unauthorized content distribution, reputational damage, or misuse of your streaming accounts. The credentials remain valid indefinitely once disclosed.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data (stream credentials) which may violate GDPR's data protection principles or HIPAA's safeguards for protected health information. Organizations using AVideo may face compliance breaches due to insufficient access controls and cryptographic weaknesses.

Mitigation Strategies

Apply the official patch from WWBN/AVideo that validates decrypted tokens as pure integers. Temporarily restrict access to the vulnerable endpoints via web server rules or firewall until patched. Monitor for unauthorized access to streaming credentials and rotate any exposed keys immediately.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82645. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart