CVE-2026-86721

Deferred Deferred - Pending Action

Authorization Bypass in AVideo via Session Cookie Override

Publication date: 2026-09-08

Last updated on: 2026-09-19

Assigner: VulnCheck

Description

AVideo through commit c3edcc274c contains an authorization bypass vulnerability where a session cookie named 'key' with value 'value' overrides the $_REQUEST['key'] parameter in saveLive.php and related endpoints. Attackers can publish to any user's RTMP stream without authentication by using the known constant stream key value to hijack live broadcasts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-19

Generated

2026-09-29

AI Q&A

2026-09-09

EPSS Evaluated

2026-09-27

NVD

CVE-2026-86721

Affected Vendors & Products

Vendor	Product	Version / Range
avideo	avideo	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

AVideo has an authorization bypass flaw where a hardcoded session cookie named 'key' with value 'value' overrides user input in saveLive.php and similar files. Attackers can exploit this to publish to any RTMP stream without authentication by using the fixed stream key, hijacking live broadcasts.

Detection Guidance

Check AVideo server logs for unauthorized RTMP stream publishing attempts or sessions with the 'key' cookie set to 'value'. Inspect saveLive.php and related endpoints for unexpected parameter overrides.

Impact Analysis

Attackers could hijack your live streams, broadcast unauthorized content under your account, or disrupt legitimate broadcasts. This could damage reputation, lead to content theft, or cause service disruptions for users relying on the platform.

Mitigation Strategies

Update AVideo to the latest commit beyond c3edcc274c. Remove or restrict access to the 'key' cookie with value 'value'. Implement strict session validation and input sanitization in saveLive.php and related endpoints.

Hi! I’m here to help you understand CVE-2026-86721. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70