CVE-2026-84187: AVideo on_publish.php Missing Authentication Check via RTMP Callback

Severity: high (CVSS 8.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-01 · updated 2026-09-08
Weakness: CWE-284

Description

AVideo contains a missing authentication vulnerability in plugin/Live/on_publish.php that allows unauthenticated attackers to mark arbitrary scheduled broadcasts as failed by sending crafted POST requests with schedule identifiers. Attackers can exploit the unguarded RTMP callback endpoint to modify scheduled broadcast status fields by supplying fabricated stream keys matching the pattern -ps-<N>, silently canceling any scheduled live broadcast without credentials or authorization.

Affected products

WWBN AVideo: through 29.0

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-v395-2xmq-cg23
https://www.vulncheck.com/advisories/avideo-on-publish-php-missing-authentication-check-via-rtmp-callback
https://github.com/WWBN/AVideo/security/advisories/GHSA-v395-2xmq-cg23

Get alerted when CVE-2026-84187 or the next vulnerability affects your stack