High severity7.5NVD Advisory· Published Sep 8, 2026

CVE-2026-86721

Description

AVideo through commit c3edcc274c contains an authorization bypass vulnerability where a session cookie named 'key' with value 'value' overrides the $_REQUEST['key'] parameter in saveLive.php and related endpoints. Attackers can publish to any user's RTMP stream without authentication by using the known constant stream key value to hijack live broadcasts.

Affected products

AVideo/AVideollm-fuzzy
Range: <c3edcc274c
WWBN/Avideollm-fuzzy
Range: <c3edcc274c

Patches

Vulnerability mechanics

References

github.com/WWBN/AVideo/security/advisories/GHSA-5664-h9h4-3gwcnvd
www.vulncheck.com/advisories/avideo-through-c3edcc274c-authorization-bypass-via-session-cookienvd

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000