CVE-2026-84187
Received Received - Intake

AVideo Missing Authentication in Live Plugin

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: VulnCheck

Description
AVideo contains a missing authentication vulnerability in plugin/Live/on_publish.php that allows unauthenticated attackers to mark arbitrary scheduled broadcasts as failed by sending crafted POST requests with schedule identifiers. Attackers can exploit the unguarded RTMP callback endpoint to modify scheduled broadcast status fields by supplying fabricated stream keys matching the pattern -ps-<N>, silently canceling any scheduled live broadcast without credentials or authorization.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-01
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-84187
EUVD
EUVD-2026-69024

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wwbn avideo to 29.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

AVideo has a missing authentication vulnerability in plugin/Live/on_publish.php that allows unauthenticated attackers to mark scheduled broadcasts as failed. Attackers can send crafted POST requests with schedule identifiers to exploit an unguarded RTMP callback endpoint. By supplying fake stream keys matching a specific pattern, they can silently cancel any scheduled live broadcast without credentials or authorization.

Detection Guidance

Monitor HTTP POST requests to plugin/Live/on_publish.php for patterns like name=anything-ps-<N> where <N> is a schedule ID. Check for repeated HTTP 401 responses despite valid requests, as the system returns identical status codes for both success and failure.

Impact Analysis

This vulnerability can completely deny scheduled live broadcasts, which are a core feature of AVideo. Attackers can silently cancel broadcasts without detection, as all requests return identical HTTP 401 responses. The attack requires only the site's hostname and can target all scheduled broadcasts by testing IDs sequentially.

Mitigation Strategies

Apply the provided patch to add Live::assertRtmpCallbackAllowed() security check in plugin/Live/on_publish.php. Ensure all RTMP callback endpoints enforce authentication and validate input parameters strictly.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84187. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart