AVideo Privilege Escalation via Token Forgery

Executive Summary

CVE-2026-88865 is an authorization bypass vulnerability in AVideo where authenticated users with canStream permission can mint tokens for arbitrary restreams without validating ownership. This allows attackers to retrieve other users' stream keys and publish content to their streaming platforms like YouTube or Twitch.

Useful 0 Not Useful 0

Detection Guidance

Check AVideo logs for suspicious activity in getRestream.json.php and getLiveKey.json.php. Monitor for unauthorized token generation or stream key retrieval requests. Review HTTP requests to these endpoints for users with canStream permission accessing unrelated restream IDs.

Useful 0 Not Useful 0

Impact Analysis

If you use AVideo, an attacker with canStream permission could steal your streaming credentials and publish unauthorized content to your YouTube, Twitch, or RTMP destinations. This could damage your reputation or broadcast malicious content under your account.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to users' stream keys and publishing rights, potentially exposing personal data or sensitive streaming content. This may violate GDPR's data protection principles if personal data is involved, and HIPAA's security rules if protected health information is streamed without authorization.

Useful 0 Not Useful 0

Mitigation Strategies

Update AVideo to the latest commit beyond c3edcc274c389816d434acadac07ee78eaf330c1. Temporarily restrict canStream permission to trusted users. Monitor getRestream.json.php and getLiveKey.json.php for unusual activity. Implement input validation to ensure restream ownership checks in these files.

Useful 0 Not Useful 0