AVIDEO · CVE-2026-126541 · Other
NO FIX YET · SEE WHAT TO DO
The AVideo Live plugin's restream endpoints do not check ownership of live stream records, so any logged-in streamer can request other users' tokens by changing a history ID. The attacker then redeems those tokens at verifyTokenForAction.json.php to get victims' HLS URLs and stream keys and publish as them or restream private and pay-per-view lives.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running AVideo through 29.7.1 with the Live plugin enabled are exposed, because the flaw is in its restream endpoints. Attackers need a logged-in streamer account on the site. Sites without the Live plugin, or running a release newer than 29.7.1, are not covered by the sources.
Not affected if auth-required, live-plugin-disabled
Who cares avideo, live-streaming, self-hosted
29.7.1.WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in Live plugin restream endpoints that allows authenticated streamers to obtain other users' stream keys by supplying arbitrary live_transmitions_history_id values. Attackers can redeem the issued action tokens at verifyTokenForAction.json.php to retrieve victims' HLS URLs and stream keys, then publish as the victim or restream private or pay-per-view lives.
This page as .md ·
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.