CVE-2026-84187: AVideo Authentication Bypass Vulnerability

CVE-2026-84187 Overview

CVE-2026-84187 is a missing authentication vulnerability in AVideo's plugin/Live/on_publish.php endpoint. The unauthenticated Real-Time Messaging Protocol (RTMP) callback handler accepts crafted POST requests that manipulate scheduled broadcast state. Attackers supply fabricated stream keys matching the pattern -ps-<N> to mark arbitrary scheduled broadcasts as failed. The flaw lets remote actors silently cancel any scheduled live broadcast without credentials, valid session tokens, or user interaction. The weakness is classified under CWE-284: Improper Access Control.

Critical Impact
Unauthenticated remote attackers can cancel any scheduled live broadcast in AVideo by sending a crafted POST request to the RTMP callback endpoint.

Affected Products

AVideo platform (WWBN/AVideo)
The plugin/Live/on_publish.php RTMP callback endpoint
Scheduled broadcast (live_schedule) functionality within the Live plugin

Discovery Timeline

2026-09-01 - CVE-2026-84187 published to the National Vulnerability Database (NVD)
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-84187

Vulnerability Analysis

The vulnerability resides in AVideo's Live plugin, specifically the on_publish.php handler that services RTMP publish callbacks from the media server. The endpoint processes stream key parameters submitted via POST without verifying the caller's identity or the authenticity of the callback source. When a stream key matches the reserved pattern -ps-<N>, the handler interprets the request as an update to the corresponding scheduled broadcast record and marks it as failed. Because the endpoint is publicly reachable and lacks any authentication or shared-secret validation, any network-based actor can invoke it directly.

Root Cause

The root cause is the absence of an authentication or authorization check on an internal-facing RTMP callback route. The handler trusts POST-supplied stream key values as evidence of a legitimate publish event from the media server. It then dispatches state changes to the live_schedule table based purely on that untrusted input. This is a classic [CWE-284] Improper Access Control condition where a privileged operation is exposed on an unguarded endpoint.

Attack Vector

Exploitation requires only network access to the AVideo instance. An attacker enumerates or guesses schedule identifiers, then issues a POST request to plugin/Live/on_publish.php with a fabricated stream key of the form -ps-<N>, where <N> corresponds to a target live_schedule row. The server accepts the request and flips the schedule status to failed, silently canceling the broadcast. No authentication, session, or user interaction is required, and the attack can be scripted to iterate through identifier ranges. For technical details, refer to the VulnCheck Advisory on AVideo Authentication and the GitHub Security Advisory GHSA-v395-2xmq-cg23.

Detection Methods for CVE-2026-84187

Indicators of Compromise

POST requests to plugin/Live/on_publish.php originating from IP addresses that are not the trusted RTMP/media server.
Request bodies containing stream key values matching the -ps-<N> pattern from unexpected sources.
Unexplained transitions of live_schedule records to a failed status without a corresponding legitimate publish event.

Detection Strategies

Review web server access logs for requests to the on_publish.php path and correlate the source IP against the expected RTMP server allowlist.
Alert on any status change to scheduled broadcast rows that does not correlate with an authenticated administrative session or a validated stream start.
Baseline normal RTMP callback volume and flag spikes or sequential enumeration of schedule identifiers in stream keys.

Monitoring Recommendations

Forward AVideo web logs and database audit events to a centralized logging pipeline for correlation.
Monitor for repeated POST requests carrying -ps- prefixed stream keys against a schedule identifier range.
Track HTTP 200 responses from on_publish.php paired with database writes to live_schedule.

How to Mitigate CVE-2026-84187

Immediate Actions Required

Restrict network access to plugin/Live/on_publish.php so that only the trusted RTMP media server can reach it, using firewall rules or a reverse proxy allowlist.
Apply the vendor patch referenced in GitHub Security Advisory GHSA-v395-2xmq-cg23 once available for your deployment.
Audit live_schedule records for unexpected failed statuses and restore any broadcasts canceled without administrator action.

Patch Information

Refer to the upstream GitHub Security Advisory GHSA-v395-2xmq-cg23 for the fixed commit and release notes. The remediation introduces authentication and callback source validation on the on_publish.php endpoint so that only legitimate RTMP publish events can modify scheduled broadcast state.

Workarounds

Place the AVideo Live plugin callback endpoint behind an internal network segment or VPN reachable only by the RTMP server.
Configure the web server or reverse proxy to require a shared secret header on requests to on_publish.php and reject requests missing it.
Temporarily disable the Live plugin if scheduled broadcasts are not in use until the patch is applied.

bash

# Example nginx configuration restricting on_publish.php to the RTMP media server
location = /plugin/Live/on_publish.php {
    allow 10.0.0.10;   # trusted RTMP server IP
    deny  all;
    include fastcgi_params;
    fastcgi_pass php-fpm;
}