CVE-2026-89252: AVideo Authentication Bypass Vulnerability

CVE-2026-89252 Overview

CVE-2026-89252 is a missing authorization vulnerability in AVideo, an open-source video platform, through commit c3edcc274c389816d434acadac07ee78eaf330c1. The flaw resides in addLiveLink.php and stems from missing ownership verification during LiveLink update operations. Any authenticated user with the canStream role can supply an existing linkId belonging to another user and overwrite that LiveLink's HTTP Live Streaming (HLS) source URL and metadata. Viewers are then redirected to attacker-controlled media without any indication of tampering. The issue is tracked under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact

An authenticated canStream user can hijack any other user's LiveLink and redirect viewers to attacker-controlled streaming media, enabling content spoofing and reputation attacks.

Affected Products

• AVideo (WWBN/AVideo) through commit c3edcc274c389816d434acadac07ee78eaf330c1
• The addLiveLink.php LiveLink update endpoint
• Deployments allowing multiple canStream-privileged users

Discovery Timeline

• 2026-09-11 - CVE-2026-89252 published to the National Vulnerability Database
• 2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-89252

Vulnerability Analysis

AVideo exposes addLiveLink.php to authenticated users who hold the canStream capability. The endpoint handles both creation and update of LiveLink records that describe an external HLS stream and its metadata. When the request contains a linkId that references an existing record, the handler proceeds directly to the update path.

The update path does not check whether the authenticated user is the owner of the referenced linkId. Any canStream user can therefore submit an update against a linkId owned by a different user. The server accepts the modified HLS source URL, title, and other metadata and persists them to the LiveLinks table. Viewers who subsequently load the stream receive attacker-supplied content in place of the original broadcast.

Root Cause

The root cause is a missing authorization check on a user-controlled identifier, matching the pattern described in CWE-639. Authentication and role verification are enforced, but the code path treats the canStream role as sufficient authority to modify any record rather than only records owned by the caller. The handler resolves the target row by linkId without joining on or comparing against the session user identifier.

Attack Vector

Exploitation is network-based and requires only low privileges. An attacker registers or already holds a canStream account, enumerates or guesses a target linkId, and issues a crafted POST request to addLiveLink.php containing that linkId and attacker-controlled fields. No user interaction is required on the victim owner's side. The compromise is limited to integrity of LiveLink records; confidentiality and availability of the underlying platform are not directly affected, consistent with the advisory scope.

For payload structure and reproduction details, see the GitHub Security Advisory GHSA-m2c6-f5ww-j26v and the VulnCheck Advisory.

Detection Methods for CVE-2026-89252

Indicators of Compromise

• LiveLink database rows where the users_id field does not match the account that most recently updated the record.
• HTTP POST requests to addLiveLink.php that include a linkId parameter belonging to a different user than the authenticated session.
• Sudden changes to HLS source URLs, titles, or thumbnails on LiveLinks that had been stable for extended periods.

Detection Strategies

• Correlate application access logs with LiveLink update events and flag any update where the requesting user is not the original owner of the linkId.
• Enable database audit logging on the LiveLinks table and alert on UPDATE statements that modify link, title, or metadata columns.
• Perform periodic integrity scans that compare current HLS source URLs against a known-good baseline maintained outside the application database.

Monitoring Recommendations

• Monitor web server logs for high-frequency POST requests to addLiveLink.php originating from a single authenticated session, which may indicate linkId enumeration.
• Track outbound stream destinations referenced by LiveLinks and alert when a URL points to a newly registered or previously unseen domain.
• Review the audit trail of accounts holding the canStream role and investigate any recently created accounts that immediately interact with addLiveLink.php.

How to Mitigate CVE-2026-89252

Immediate Actions Required

• Upgrade AVideo to a commit released after c3edcc274c389816d434acadac07ee78eaf330c1 that includes the ownership check in addLiveLink.php.
• Audit the LiveLinks table for unauthorized modifications and restore altered HLS source URLs from a trusted backup.
• Rotate credentials for any canStream accounts that show suspicious activity and disable dormant accounts holding this role.

Patch Information

Refer to the GitHub Security Advisory GHSA-m2c6-f5ww-j26v for the authoritative fix and remediated commit range. Administrators should apply the upstream patch that enforces an ownership comparison between the session user and the users_id associated with the requested linkId before any update is committed.

Workarounds

• Restrict the canStream role to trusted operators only and revoke it from self-registered or low-trust accounts until the patch is applied.
• Place addLiveLink.php behind a reverse proxy rule that inspects requests and rejects updates where the session user does not match the linkId owner.
• Disable the LiveLinks feature entirely in deployments where it is not required, using the AVideo administrative configuration.

# Example nginx rule to log and inspect LiveLink update attempts
location = /plugin/Live/addLiveLink.php {
    access_log /var/log/nginx/avideo_livelink.log combined;
    limit_req zone=livelink_zone burst=5 nodelay;
    proxy_pass http://avideo_backend;
}