CVE-2019-7654

Wowza Streaming Engine 4.8.0 and earlier suffers from multiple CSRF vulnerabilities. For example, an administrator, by following a link, can be tricked into making unwanted changes such as adding another admin user via enginemanager/server/user/edit.htm in the Server->Users component. This issue was resolved in Wowza Streaming Engine 4.8.5.

• CWE-352

• https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-7654-CSRF-WowzaExploit, Third Party Advisory
• https://raw.githubusercontent.com/WowzaMediaSystems/public_cve/main/wowza-streaming-engine/CVE-2019-7654.txtThird Party Advisory
• https://www.wowza.com/docs/wowza-streaming-engine-4-8-5-release-notesRelease Notes, Vendor Advisory
• https://www.wowza.com/pricing/installerVendor Advisory
• https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-7654-CSRF-WowzaExploit, Third Party Advisory
• https://raw.githubusercontent.com/WowzaMediaSystems/public_cve/main/wowza-streaming-engine/CVE-2019-7654.txtThird Party Advisory
• https://www.wowza.com/docs/wowza-streaming-engine-4-8-5-release-notesRelease Notes, Vendor Advisory
• https://www.wowza.com/pricing/installerVendor Advisory

Published

Jan 29, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-7646CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8…
• CVE-2019-7648controller/fetchpwd.php and controller/doAction.php in Hotel…
• CVE-2019-7649global.encryptPassword in bootstrap/global.js in CMSWing 1.3…
• CVE-2019-7651EPP.sys in Emsisoft Anti-Malware prior to version 2018.12 al…
• CVE-2019-7652TheHive Project UnshortenLink analyzer before 1.1, included …
• CVE-2019-7653The Debian python-rdflib-tools 4.2.2-1 package for RDFLib 4.…9.8
• CVE-2019-7655Wowza Streaming Engine 4.8.0 and earlier from multiple authe…5.4
• CVE-2019-7656A privilege escalation vulnerability in Wowza Streaming Engi…7.8
• CVE-2019-7659Genivia gSOAP 2.7.x and 2.8.x before 2.8.75 allows attackers…
• CVE-2019-7660An issue was discovered in PHPMyWind 5.5. The username param…
• CVE-2019-7661An issue was discovered in PHPMyWind 5.5. The method paramet…
• CVE-2019-7662An assertion failure was discovered in wasm::WasmBinaryBuild…6.5