SQL Injection Vulnerability in AVideo Video-Sharing Platform

CVE-2026-61569

What is CVE-2026-61569?

A serious SQL injection vulnerability exists in AVideo's video-sharing platform prior to version 8.1.0. This flaw allows attackers to exploit unauthenticated access through improper handling of the user parameter in objects/login.json.php. The vulnerability results from direct interpolation of this parameter into a MariaDB SELECT query without adequate parameterization or escaping measures. Despite attempts to sanitize inputs in security.php, the process is ineffective as it can be reversed through html_entity_decode in Login.php, thus exposing the system to potential data breaches. Attackers can exploit this to gain unauthorized access to sensitive upstream streamer credentials and database configurations. The ability to read arbitrary database data poses significant security risks, including the potential for prolonged unauthorized access until credentials are rotated. This vulnerability has been addressed in version 8.1.0 of AVideo.

References