CVE-2026-61569

AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated streamer login at `objects/login.json.php` passes the `user` parameter to `Streamer::get` in `objects/Streamer.php`, where it is interpolated into a single-quoted MariaDB SELECT without parameterization or escaping. Although `objects/security.php` strips literal single quotes, `html_entity_decode` in `objects/Login.php` restores entity-encoded quotes before the query. The supplied `siteURL` must pass the streamer allowlist, which allows all sites when empty by default, and an attacker-hosted login response must set `canUpload` or `isAdmin` to reach `Streamer::createIfNotExists`. That function calls `Streamer::get` before its additional allowlist check. UNION results are exposed through `streamers_id`, while failures return the rendered query and MariaDB error. An attacker can read arbitrary encoder database data, including stored upstream streamer credentials, allowlist configuration, and queue records, without encoder credentials. Stacked statements are not permitted by the mysqli driver and the tested database account lacks global FILE privilege, so the demonstrated vector is bounded to reads rather than server-side file writes. Stolen streamer credentials can provide continued upstream access until rotated. This issue is fixed in version 8.1.0.

• CWE-89

• https://github.com/WWBN/AVideo-Encoder/commit/8a6e2b8aedb87702656636d3fc8d9e26e559a762
• https://github.com/WWBN/AVideo-Encoder/releases/tag/v8.1.0
• https://github.com/WWBN/AVideo-Encoder/security/advisories/GHSA-2rrq-xf8q-3qpf
• https://github.com/WWBN/AVideo-Encoder/security/advisories/GHSA-2rrq-xf8q-3qpf

Published

Oct 28, 2026

Last Modified

Oct 29, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-61559`@zereight/mcp-gitlab` is a Model Context Protocol server fo…9.6
• CVE-2026-6156A security vulnerability has been detected in Totolink A7100…9.8
• CVE-2026-61560`@zereight/mcp-gitlab` is a Model Context Protocol server fo…9.8
• CVE-2026-61564AVideo is a video-sharing Platform. Prior to 8.1.0, the unau…10
• CVE-2026-61567AVideo is a video-sharing Platform. Prior to 8.1.0, the live…10
• CVE-2026-61568`@zereight/mcp-gitlab` is a Model Context Protocol server fo…9.6
• CVE-2026-6157A vulnerability was detected in Totolink A800R 4.1.2cu.5137_…8.8
• CVE-2026-61570MPXJ is an open source library to read and write project pla…7.5
• CVE-2026-61571AVideo is a video-sharing Platform. Prior to 8.1.0, the enco…7.3
• CVE-2026-61572AVideo is a video-sharing Platform. Before the initial remed…8.6
• CVE-2026-61573AVideo is a video-sharing Platform. Prior to 8.1.0, the anon…6.1
• CVE-2026-61574authentik is an open-source identity provider. Prior to 2026…8.8