CVE-2026-85162
Received Received - Intake

AVideo CSRF Vulnerability Allows Live Stream Hijacking

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: VulnCheck

Description
AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in plugin/Live/saveLive.php that lacks forbidIfNotPost and forbidIfInvalidToken protections. Attackers can craft malicious image tags to overwrite authenticated streamers' RTMP keys, passwords, and titles, hijacking live broadcasts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-03
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-85162
EUVD
EUVD-2026-70397

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
avideo avideo *
wwbn avideo to c91b5975d (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-85162 is a Cross-Site Request Forgery (CSRF) vulnerability in AVideo's plugin/Live/saveLive.php file. It lacks protections like forbidIfNotPost and forbidIfInvalidToken, allowing attackers to craft malicious image tags that overwrite authenticated streamers' RTMP keys, passwords, and titles to hijack live broadcasts.

Detection Guidance

To detect this CSRF vulnerability in AVideo, inspect the plugin/Live/saveLive.php file for missing CSRF protections like forbidIfNotPost() and forbidIfInvalidToken(). Check if the endpoint processes $_REQUEST inputs without proper validation. Monitor network traffic for unauthorized GET requests to this endpoint that modify stream settings.

Impact Analysis

Attackers can hijack live streams by tricking streamers into visiting malicious pages. This could lead to stream key theft, unauthorized password changes, stream title manipulation, or complete stream takeover. Streamers may lose control of their broadcasts or be locked out.

Mitigation Strategies

Immediately update AVideo to the latest version beyond commit c91b5975d. Add CSRF protections by implementing forbidIfNotPost() and forbidIfInvalidToken() in plugin/Live/saveLive.php. Restrict access to the saveLive.php endpoint and review user permissions to ensure only authorized users can modify stream settings.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85162. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart