CVE-2026-86721: AVideo Authorization Bypass Vulnerability

CVE-2026-86721 Overview

CVE-2026-86721 is an authorization bypass vulnerability in AVideo through commit c3edcc274c. The flaw resides in saveLive.php and related endpoints where a session cookie named key with value value overrides the $_REQUEST['key'] parameter. Attackers can publish to any user's Real-Time Messaging Protocol (RTMP) stream without authentication by supplying the known constant stream key value. The issue is tracked under [CWE-287: Improper Authentication].

Critical Impact
Unauthenticated remote attackers can hijack any live broadcast on a vulnerable AVideo instance by injecting content into arbitrary users' RTMP streams.

Affected Products

AVideo (WWBN) through commit c3edcc274c
AVideo saveLive.php endpoint
Related RTMP stream key validation endpoints

Discovery Timeline

2026-09-08 - CVE-2026-86721 published to the National Vulnerability Database (NVD)
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86721

Vulnerability Analysis

AVideo is an open-source video streaming platform that supports live broadcasting over RTMP. The authorization logic in saveLive.php reads a stream key that is intended to authenticate the broadcaster to a specific channel. The implementation checks a session cookie named key before it consults the $_REQUEST['key'] parameter supplied by the client. When the cookie is present with the literal value value, it silently overrides the parameter, allowing the code path to treat any request as authorized.

The result is that anonymous network attackers can publish arbitrary media to any user's live broadcast. Because RTMP publishing controls what viewers see on a channel, hijacked streams can be used to defame content creators, distribute unauthorized content, or damage platform trust.

Root Cause

The root cause is precedence of an untrusted session cookie over the request-scoped stream key value. The application accepts a well-known constant (value) as a valid authorization token without validating it against the authenticated user's identity or a per-user secret. This is a classic Improper Authentication weakness where a shared constant substitutes for a genuine credential.

Attack Vector

Exploitation requires no authentication, no user interaction, and only network access to the AVideo instance. An attacker sets the cookie key=value in an HTTP request to saveLive.php (or a related endpoint) and issues an RTMP publish operation against the target channel. The server accepts the publish, and the attacker's stream replaces or occupies the victim's live broadcast. See the GitHub Security Advisory GHSA-5664 and the VulnCheck AVideo Authorization Bypass Advisory for additional technical detail.

Detection Methods for CVE-2026-86721

Indicators of Compromise

HTTP requests to saveLive.php or related live endpoints carrying a Cookie: key=value header from unauthenticated sessions.
Unexpected RTMP publish events on user channels that do not correlate with authenticated logins in application logs.
Sudden changes in live stream content, bitrate, or source IP address for an established broadcaster.

Detection Strategies

Inspect web server access logs for requests to live-broadcast endpoints containing the literal cookie value key=value.
Correlate RTMP publish events with authenticated user sessions and alert on mismatches between the publishing IP and the account owner's historical addresses.
Deploy a Web Application Firewall (WAF) rule that flags or blocks inbound requests to AVideo endpoints when the key cookie equals the constant value.

Monitoring Recommendations

Enable verbose logging on the RTMP publish handler to capture cookie headers, source IPs, and target channel identifiers.
Baseline normal broadcaster behavior and alert on new publisher IPs or geolocations for existing channels.
Forward AVideo application and RTMP logs to a centralized analytics platform for retrospective hunting on the key=value indicator.

How to Mitigate CVE-2026-86721

Immediate Actions Required

Update AVideo to a commit later than c3edcc274c that removes the cookie-based override of $_REQUEST['key'].
Rotate all existing stream keys for every broadcaster after patching to invalidate any keys that may have been exposed.
Audit recent broadcasts and web server logs for the key=value cookie indicator to identify prior hijack attempts.

Patch Information

Refer to the upstream GitHub Security Advisory GHSA-5664 for the fixed commit and patch details. The corrective change removes the precedence of the session cookie over the request parameter and enforces per-user stream key validation.

Workarounds

Block requests to AVideo live endpoints where the HTTP Cookie header contains key=value using a reverse proxy or WAF rule.
Restrict RTMP publishing to trusted source IP ranges until the platform is patched.
Disable live streaming functionality entirely on public instances that cannot be updated immediately.

bash

# Example NGINX rule to block the known bypass cookie
if ($http_cookie ~* "(^|;\s*)key=value(;|$)") {
    return 403;
}