CVE-2026-82645
Last modified
CVE-2026-82645 is a high-severity vulnerability rated 8.6/10 on the CVSS scale. AVideo (current commit e01e41ecc and earlier) exposes stream credentials through the plugin/Live/view/Live_restreams/getLiveKey.json.php endpoint. Supplying a 'token' request parameter waives both the Live::canRestream() access gate and the restream ownership check, causing the endpoint to return any restream's stream_key and stream_url (credentials for external platforms such as YouTube, Facebook, and Twitch) without authentication. EPSS estimates a 0.13% chance of exploitation in the next 30 days.
Description
AVideo (current commit e01e41ecc and earlier) exposes stream credentials through the plugin/Live/view/Live_restreams/getLiveKey.json.php endpoint. Supplying a 'token' request parameter waives both the Live::canRestream() access gate and the restream ownership check, causing the endpoint to return any restream's stream_key and stream_url (credentials for external platforms such as YouTube, Facebook, and Twitch) without authentication. The token is merely encryptString() of an integer id with no user binding, expiry, or authentication tag. Because encryption uses AES-256-CBC with a deterministic IV and no MAC, and because intval() accepts any string beginning with a digit, an unauthenticated attacker can forge valid tokens using the public encryption oracle in view/url2Embed.json.php, disclosing arbitrary users' stream credentials.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| WWBN | AVideo | All versions |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-82645?
How severe is CVE-2026-82645?
How do I fix CVE-2026-82645?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-8264A weakness has been identified in Tenda AC6 15.03.06.23. Aff…8.8
- CVE-2026-82640browser-use web-ui versions 2.0.0 through 3.0.0 write config…5.5
- CVE-2026-82641Keploy versions 3.1.0 through 3.6.25, fixed in 3.6.26, bind …8.6
- CVE-2026-82642Readest is an open-source e-book reader built on Tauri. In v…8.8
- CVE-2026-82643WWBN AVideo contains an unauthenticated credential submissio…6.5
- CVE-2026-82644WWBN AVideo (current e01e41ecc and earlier) contains a brute…7.5
- CVE-2026-82646WWBN AVideo contains an unauthenticated reflected cross-site…6.1
- CVE-2026-82647WWBN AVideo contains a cross-site request forgery vulnerabil…6.1
- CVE-2026-82648WWBN AVideo contains a server-side request forgery filter by…7.1
- CVE-2026-82649SiYuan Windows installer before version 3.8.1 (affected vers…7
- CVE-2026-8265A security vulnerability has been detected in Tenda AC6 15.0…7.2
- CVE-2026-82650SiYuan 3.8.0 contains a path traversal / sensitive file expo…4.4
Are you affected by CVE-2026-82645?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST