AVideo CVE-2026-82645

No special conditions beyond a reachable AVideo instance with the Live/restream plugin enabled - remote unauthenticated exploitation works against default configurations where the getLiveKey.json.php and url2Embed.json.php endpoints are network-accessible (AV:N/AC:L/PR:N/UI:N). The concrete prerequisite is that the Live plugin's restream feature is active (so the endpoint exists and restream records with stream_key/stream_url are present); on installations without the Live restream feature there is nothing to disclose. The only meaningful limiting factors are enablement of that plugin and network reachability of the two endpoints; no credentials, user interaction, or non-default settings are required.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N, base 9.2 Critical) is well supported by the description: fully network-reachable, low complexity, no privileges, no user interaction, high confidentiality impact on both the vulnerable system and subsequent systems (the external streaming accounts whose credentials leak). The SC:H is meaningful here because leaked stream keys grant control of victims' YouTube/Facebook/Twitch broadcasts, not just AVideo data. No EPSS score, KEV entry, or POC flag is provided, so there is no evidence of active exploitation or published exploit code; however, the advisory gives a complete forgery recipe (oracle endpoint + intval quirk), lowering the practical barrier considerably. Impact is confidentiality-only - no integrity or availability effect - which slightly narrows blast radius but stream-key disclosure enables downstream account takeover/broadcast hijacking on third-party platforms. Net: a genuine high priority for any AVideo deployment with the Live/restream feature, tempered by the product's limited footprint and absence of confirmed in-the-wild use.

An unauthenticated attacker first calls the public url2Embed.json.php oracle to encrypt a target restream id, obtaining a valid AES-256-CBC token. They then request getLiveKey.json.php with that forged token, and the endpoint returns the victim's stream_key and stream_url without any authentication. Armed with the stream key, the attacker can hijack the victim's YouTube/Facebook/Twitch broadcast. No public exploit is identified at time of analysis, but the advisory documents each step.