Authentication Bypass in AVideo Stream Management by WWBN

CVE-2026-88865

What is CVE-2026-88865?

A significant vulnerability in AVideo allows authenticated users with 'canStream' permissions to exploit a failure in validating restream ownership via the getRestream.json.php script. This oversight enables attackers to mint tokens for arbitrary restreams, which they can then utilize to retrieve other users' stream keys from getLiveKey.json.php. Consequently, this can lead to unauthorized streaming on platforms such as YouTube, Twitch, or through RTMP destinations. A patch is necessary to mitigate the risk of exploitation.

References