AVideo-Encoder CVE-2026-61567

No credentials, tokens, or operator configuration are required, and exploitation works against default configurations because this endpoint performs no authentication, no APISecret comparison against a stored secret, and never calls Streamer::isURLAllowed, so the operator's streamer allowlist does not limit it. The concrete prerequisites are: the encoder's view/videosListToLive.php endpoint (mapped via .htaccess to /videosListToLive) must be network-reachable by the attacker, and the attacker must be able to host an HTTP service that the encoder can resolve and reach outbound (the encoder makes server-side requests to the attacker-named webSiteRootURL with TLS verification disabled). The request needs only non-empty playlists_id and APISecret values plus user/pass/webSiteRootURL. The only real limiting factor is outbound reachability from the encoder to the attacker-controlled host; there is no user-interaction, authentication, or non-default-setting barrier.

All severity signals align toward maximum priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H = 10.0) describes unauthenticated, low-complexity, network-reachable remote code execution with a scope change and total confidentiality/integrity/availability impact, and the independent vuln.today decision label is 'act_now,' indicating no deferral. CWE-78 OS command injection is confirmed by both NVD and the vendor GHSA advisory (GHSA-rf63-6vwm-wv8p), and the advisory ships a complete step-by-step proof-of-concept (attacker HTTP stub plus a single curl request writing id to /tmp and firing an out-of-band callback), so the exploitation mechanism is fully documented rather than theoretical. No CISA KEV listing and no EPSS score were provided in the input, so there is no evidence of active in-the-wild exploitation and no modeled exploitation probability to cite - this is a priority driven by trivial exploitability and documented PoC, not by observed campaigns. The one caveat against indiscriminate mass exploitation is the real-world footprint: AVideo-Encoder is a niche open-source product, so widespread automated attacks are less likely than targeted hits against known deployments, but any reachable encoder should be treated as urgently exploitable.

An attacker stands up a small HTTP server impersonating an AVideo platform, then sends one anonymous request to the encoder's view/videosListToLive.php naming that server in webSiteRootURL with any non-empty APISecret and numeric playlists_id. The encoder logs into the attacker site, trusts the returned JSON to self-grant isLogged/canStream, fetches an attacker-controlled video list, and interpolates a videos[].path value containing shell metacharacters unescaped into ffprobe/ffmpeg commands run via exec, executing arbitrary commands as the web-server user. A full working PoC with this exact flow is published in the vendor GHSA advisory.