CVE-2026-85162CWE-352csrf

CVE-2026-85162

Medium · published September 3, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
6.5
In the wild
Unconfirmed
What it is

AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in plugin/Live/saveLive.php that lacks forbidIfNotPost and forbidIfInvalidToken protections. Attackers can craft malicious image tags to overwrite authenticated streamers' RTMP keys, passwords, and titles, hijacking live broadcasts.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00174 · 6.5th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2026-09-03T17:06Z
References (3)
https://github.com/WWBN/AVideo/security/advisories/GHSA-6jj8-2953-6frf · [email protected]https://www.vulncheck.com/advisories/avideo-through-c91b5975d-csrf-via-savelive-php · [email protected]https://github.com/WWBN/AVideo/security/advisories/GHSA-6jj8-2953-6frf · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 05 SEP 03:44Z
    EPSS moved — → 0%
    epss
  • 03 SEP 11:22Z
    AVideo through c91b5975d CSRF via saveLive.php
    cvelistv5