CVE-2026-86721CWE-287

CVE-2026-86721

High · published September 8, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
41.6
In the wild
Unconfirmed
What it is

AVideo through commit c3edcc274c contains an authorization bypass vulnerability where a session cookie named 'key' with value 'value' overrides the $_REQUEST['key'] parameter in saveLive.php and related endpoints. Attackers can publish to any user's RTMP stream without authentication by using the known constant stream key value to hijack live broadcasts.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00495 · 41.6th percentile
Weakness
CWE-287 · Improper Authentication
Published
2026-09-08T20:18Z
References (2)
https://github.com/WWBN/AVideo/security/advisories/GHSA-5664-h9h4-3gwc · [email protected]https://www.vulncheck.com/advisories/avideo-through-c3edcc274c-authorization-bypass-via-session-cookie · [email protected]
EPSS history
Timeline
  • 10 SEP 03:18Z
    EPSS moved — → 0%
    epss
  • 08 SEP 15:13Z
    AVideo through c3edcc274c Authorization Bypass via Session Cookie
    cvelistv5