CVE-2026-88865CWE-639

CVE-2026-88865

High · published September 10, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
29.0
In the wild
Unconfirmed
What it is

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate restream ownership in getRestream.json.php, allowing authenticated users with canStream permission to mint tokens for arbitrary restreams. Attackers can exchange the token to retrieve other users' stream keys from getLiveKey.json.php and publish to their YouTube, Twitch, or RTMP destinations.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
8.6 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00363 · 29.0th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-09-10T18:17Z
References (2)
https://github.com/WWBN/AVideo/security/advisories/GHSA-7jf4-mmqm-7p7x · [email protected]https://www.vulncheck.com/advisories/avideo-missing-authorization-via-getrestream-json-php · [email protected]
EPSS history
Timeline
  • 12 SEP 03:22Z
    EPSS moved — → 0%
    epss
  • 10 SEP 13:05Z
    AVideo Missing Authorization via getRestream.json.php
    cvelistv5