Privilege Escalation in Wowza Streaming Engine by Wowza Media Systems
CVE-2016-20034

8.7HIGH

Key Information:

Vendor: Wowza Media Systems, Llc.
Status: Wowza Streaming Engine
Vendor: CVE Published:; 15 March 2026

🔔 Create Wowza Media Systems, Llc. Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2016-20034?

The Wowza Streaming Engine version 4.5.0 is vulnerable to a privilege escalation attack that allows authenticated read-only users to gain administrative privileges. This is achieved by exploiting the user edit endpoint through maliciously crafted POST requests. By setting the accessLevel parameter to 'admin' and the advUser parameters to 'true' and 'on', an attacker can elevate their privileges from that of a read-only user to an administrator, potentially compromising the entire streaming environment.

Affected Version(s)

Wowza Streaming Engine 4.5.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2016-20034 - Proof of Concept