What’s Vulnerable › Vulnerabilities

CVE-2016-20035: Wowza Streaming Engine 4.5.0 CSRF via user edit endpoint

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-03-16 · updated 2026-06-17
• Weakness: CWE-352

Description

Wowza Streaming Engine 4.5.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions by crafting malicious web pages. Attackers can trick logged-in administrators into visiting a malicious site that submits POST requests to the user edit endpoint to create new admin accounts with arbitrary credentials.

Affected products

• Wowza Streaming Engine: 4.5.0

References

• http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5341.php
• https://www.exploit-db.com/exploits/40134
• https://www.vulncheck.com/advisories/wowza-streaming-engine-csrf-via-user-edit-endpoint

Get alerted when CVE-2016-20035 or the next vulnerability affects your stack