CVE-2026-33716CWE-287

AVideo Allows Unauthenticated Live Stream Control via Token Verification URL Override in control.json.php

Critical · published March 23, 2026

CVSS v3.1
9.4
EPSS
1%
Percentile
47.8
In the wild
Unconfirmed
What it is

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the standalone live stream control endpoint at `plugin/Live/standAloneFiles/control.json.php` accepts a user-supplied `streamerURL` parameter that overrides where the server sends token verification requests. An attacker can redirect token verification to a server they control that always returns `{"error": false}`, completely bypassing authentication. This grants unauthenticated control over any live stream on the platform, including dropping active publishers, starting/stopping recordings, and probing stream existence. Commit 388fcd57dbd16f6cb3ebcdf1d08cf2b929941128 contains a patch.

The record
Technical detail
CVSS v3.1
9.4 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00597 · 47.8th percentile
Weakness
CWE-287 · Improper Authentication
Published
2026-03-23T18:46Z
EPSS history
Timeline
  • 23 MAR 18:46Z
    AVideo Allows Unauthenticated Live Stream Control via Token Verification URL Override in control.json.php
    cvelistv5