CVE-2026-88865: AVideo Missing Authorization via getRestream.json.php

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-10 · updated 2026-09-18
Weakness: CWE-639

Description

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate restream ownership in getRestream.json.php, allowing authenticated users with canStream permission to mint tokens for arbitrary restreams. Attackers can exchange the token to retrieve other users' stream keys from getLiveKey.json.php and publish to their YouTube, Twitch, or RTMP destinations.

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-7jf4-mmqm-7p7x
https://www.vulncheck.com/advisories/avideo-missing-authorization-via-getrestream-json-php

Get alerted when CVE-2026-88865 or the next vulnerability affects your stack