CVE-2026-86720: WWBN AVideo Authentication Bypass Vulnerability

CVE-2026-86720 Overview

CVE-2026-86720 is a missing authorization flaw in WWBN AVideo, an open-source video streaming platform. The vulnerability resides in resendRestreamer.json.php, which fails to validate ownership of the live_restreams_id parameter. Authenticated users holding the canStream permission can supply arbitrary live_restreams_id values to access restream destinations configured by other users. Attackers can then broadcast their own live stream to victim-owned YouTube, Facebook, or Twitch destinations using the victim's stored stream keys. The issue affects AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 and is categorized under [CWE-639: Authorization Bypass Through User-Controlled Key].

Critical Impact
Authenticated attackers can hijack third-party streaming destinations (YouTube, Facebook, Twitch) belonging to other AVideo users by referencing arbitrary restream identifiers.

Affected Products

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1
AVideo instances exposing resendRestreamer.json.php
Deployments granting the canStream permission to non-privileged users

Discovery Timeline

2026-09-08 - CVE-2026-86720 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86720

Vulnerability Analysis

AVideo exposes an internal endpoint, resendRestreamer.json.php, that reissues a live restream request to a configured destination such as YouTube, Facebook, or Twitch. The endpoint accepts a live_restreams_id value that maps to a stored destination record containing the target platform URL and stream key. The endpoint does not verify that the referenced record belongs to the authenticated caller. Any authenticated user with the canStream capability can therefore reference destination records owned by other users and reuse them to relay a live broadcast.

The flaw is an Insecure Direct Object Reference in which the object identifier is treated as authoritative without an ownership check. The result is a horizontal privilege escalation across tenants of the same AVideo instance.

Root Cause

The root cause is missing authorization on a user-controlled key. The application authenticates the session and confirms the canStream role but omits the WHERE users_id = :current_user constraint when loading the live_restreams record. Access decisions collapse to authentication, so any authenticated streamer can address any restream record by numeric identifier.

Attack Vector

The attack is remote and requires only low-privileged authenticated access. An attacker enumerates or guesses live_restreams_id values, submits a crafted request to resendRestreamer.json.php, and starts their own live source. AVideo forwards the stream to the victim's configured destination using the victim's stored stream key. The victim's YouTube, Facebook, or Twitch channel then publishes attacker-controlled content.

No verified public exploit code is available. Technical detail is documented in the GitHub Security Advisory GHSA-7c8r-rj82-c8fv and the VulnCheck Advisory on AVideo.

Detection Methods for CVE-2026-86720

Indicators of Compromise

HTTP requests to resendRestreamer.json.php where the authenticated users_id does not match the owner of the referenced live_restreams_id.
Unexpected outbound RTMP sessions from the AVideo host to YouTube, Facebook, or Twitch ingest endpoints.
User complaints reporting foreign content published to their linked third-party streaming channels.
Log entries showing sequential or enumerated live_restreams_id values from a single session.

Detection Strategies

Correlate web server access logs for resendRestreamer.json.php against the live_restreams table to flag ownership mismatches.
Alert on any account issuing restream calls against more than one distinct live_restreams_id owner within a short window.
Baseline expected restream destinations per user and alert on new or unauthorized platform targets.

Monitoring Recommendations

Enable verbose PHP request logging on the AVideo application to capture parameters passed to restream endpoints.
Forward web, application, and RTMP egress logs to a centralized analytics platform for cross-source correlation.
Review audit trails for changes to canStream role assignments and for new restream destinations added by low-privileged accounts.

How to Mitigate CVE-2026-86720

Immediate Actions Required

Update AVideo to a build that includes the fix released after commit c3edcc274c389816d434acadac07ee78eaf330c1.
Audit user accounts holding the canStream permission and revoke it from accounts that do not require live streaming.
Rotate stream keys stored for YouTube, Facebook, Twitch, and any other configured restream destinations.
Review restream activity logs for the past 30 days and notify users whose destinations were used by another account.

Patch Information

Refer to the GitHub Security Advisory GHSA-7c8r-rj82-c8fv for the patched commit and upgrade guidance. The fix introduces an ownership check that binds live_restreams_id lookups to the authenticated user identifier.

Workarounds

Restrict network access to resendRestreamer.json.php using a web application firewall rule that requires an internal referer.
Limit the canStream role to trusted accounts and disable open user registration until the patch is applied.
Temporarily disable the restream feature by removing stored destinations if live restreaming is not in active use.

bash

# Example WAF rule to block external requests to the vulnerable endpoint
# ModSecurity syntax
SecRule REQUEST_URI "@endsWith /plugin/Live/standAloneFiles/resendRestreamer.json.php" \
  "id:1026867200,phase:1,deny,status:403,log,msg:'CVE-2026-86720 restream endpoint blocked'"