CVE-2026-92912: AVideo RTMP Authentication Bypass Vulnerability

CVE-2026-92912 Overview

CVE-2026-92912 affects AVideo, an open-source video streaming platform, through commit c3edcc274c389816d434acadac07ee78eaf330c1. The LiveTransmition component generates Real-Time Messaging Protocol (RTMP) publish keys using PHP's uniqid() function, which relies on the current time and is not cryptographically secure. The resulting key entropy collapses to roughly one million possibilities per creation second. Attackers who know the channel creation time can brute-force the five-digit microsecond component to forge valid stream keys and broadcast content as the legitimate channel owner. The weakness maps to [CWE-330: Use of Insufficiently Random Values].

Critical Impact

Attackers can forge RTMP publish keys and stream arbitrary content under a victim channel's identity, enabling account impersonation and content integrity compromise.

Affected Products

• AVideo (WWBN/AVideo) through commit c3edcc274c389816d434acadac07ee78eaf330c1
• LiveTransmition module responsible for RTMP publish key issuance
• Deployments exposing live streaming endpoints over the network

Discovery Timeline

• 2026-09-17 - CVE-2026-92912 published to NVD
• 2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-92912

Vulnerability Analysis

AVideo issues RTMP publish keys used by streamers to authenticate their broadcast to the ingest server. In the vulnerable LiveTransmition code path, the key is derived from PHP's uniqid() output. uniqid() returns a value based on the current Unix timestamp in seconds plus a five-digit microsecond suffix. It is not intended as a cryptographic primitive and provides no unpredictability guarantees.

Because the second-precision portion of the timestamp is often observable or inferable from channel metadata, an attacker only needs to guess the microsecond suffix. That reduces the search space to approximately 10^6 candidates per creation second, which is trivially brute-forceable against the RTMP ingest endpoint.

Root Cause

The root cause is misuse of a time-based identifier generator for a security-sensitive secret. uniqid() is documented as unsuitable for cryptographic purposes, yet it produces the publish key that authorizes stream ingestion. No additional entropy, HMAC, or cryptographically secure pseudorandom number generator (CSPRNG) such as random_bytes() is applied.

Attack Vector

An attacker enumerates candidate microsecond values for a target channel's estimated creation timestamp and submits RTMP publish attempts using each derived key. When a candidate matches the stored key, the ingest server accepts the stream and the attacker broadcasts content under the victim channel. The attack requires network access to the RTMP endpoint and knowledge or estimation of the channel creation time. No authentication is required.

See the GitHub Security Advisory GHSA-h983-2mcw-672j and the VulnCheck Advisory on AVideo for additional technical detail.

Detection Methods for CVE-2026-92912

Indicators of Compromise

• Multiple failed RTMP publish attempts against the same stream path within a short window, indicating key brute-force enumeration.
• Successful RTMP publish sessions originating from IP addresses or user agents that differ from the channel owner's historical baseline.
• Unexpected changes in live stream content, thumbnails, or duration for channels the owner did not activate.

Detection Strategies

• Instrument the RTMP ingest server to log every publish attempt with stream key hash, source IP, and outcome, then alert on high failure-to-success ratios per channel.
• Correlate channel creation timestamps with subsequent publish activity to flag ingest attempts that arrive far outside the owner's usual broadcast pattern.
• Review AVideo application logs for concurrent or overlapping publish sessions on the same channel identifier.

Monitoring Recommendations

• Monitor for enumeration-style traffic bursts against /live or configured RTMP ingest ports.
• Track anomalous geo or ASN shifts for authenticated broadcaster sessions and alert on new source networks.
• Retain RTMP access and application logs long enough to reconstruct the full window between channel creation and first broadcast.

How to Mitigate CVE-2026-92912

Immediate Actions Required

• Rotate all existing RTMP publish keys for channels created on the affected commit so previously guessable keys become invalid.
• Restrict RTMP ingest exposure to trusted networks or place it behind an authenticated reverse proxy until keys are regenerated with strong entropy.
• Audit recent broadcasts for unauthorized streams and disable any channels showing suspicious publish activity.

Patch Information

Refer to the GitHub Security Advisory GHSA-h983-2mcw-672j for fixed commits and upgrade guidance. Administrators should update AVideo past commit c3edcc274c389816d434acadac07ee78eaf330c1 and confirm that key generation uses a CSPRNG such as random_bytes() combined with a sufficient key length.

Workarounds

• Replace uniqid()-based key generation with bin2hex(random_bytes(32)) or equivalent CSPRNG output in local deployments where an immediate upgrade is not possible.
• Enforce IP allowlisting on the RTMP ingest server so only known broadcaster networks can submit publish requests.
• Add per-channel rate limiting and lockout on repeated failed publish attempts to defeat brute-force enumeration of the microsecond space.

# Configuration example: restrict RTMP ingest to known broadcaster IPs (nginx-rtmp)
rtmp {
    server {
        listen 1935;
        application live {
            live on;
            allow publish 203.0.113.0/24;
            deny publish all;
            allow play all;
        }
    }
}