CVE-2026-86721

8.7 highEPSS 0.5%

High (8.7). EPSS 0.5% chance of exploitation in the next 30 days.

AVideo through commit c3edcc274c contains an authorization bypass vulnerability where a session cookie named 'key' with value 'value' overrides the $_REQUEST['key'] parameter in saveLive.php and related endpoints. Attackers can publish to any user's RTMP stream without authentication by using the known constant stream key value to hijack live broadcasts.

Severity

CVSS 4.0

8.7 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 42% of CVEs (scores of 2026-10-31)
CWE: CWE-287
Published: 2026-09-08
Modified: 2026-09-19
Record from: the NVD, synced 2026-10-19

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-5664-h9h4-3gwc
https://www.vulncheck.com/advisories/avideo-through-c3edcc274c-authorization-bypass-via-session-cookie

Check your stack JSON