WWBN AVideo CVE-2026-85162

The victim must be an authenticated AVideo streamer with an active session at the time of the attack - the CVSS UI:P metric reflects this passive interaction requirement. The attacker requires no credentials or account on the AVideo instance. Exploitation is limited to AVideo deployments running the Live plugin through commit c91b5975d; the plugin does not appear to require any non-default configuration beyond being enabled. The attack does not expose RTMP credentials for reading - it overwrites them - so confidentiality of existing keys is not directly at risk through this vector alone.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VI:H) accurately characterizes the attack: no authentication is required of the attacker, complexity is low, and the integrity impact to the victim's stream session is high. However, the attack is gated on passive user interaction - the authenticated streamer must visit an attacker-controlled page while logged in, which meaningfully constrains autonomous exploitation. The practical impact is account-level hijacking of a live broadcast rather than server compromise: replacing the RTMP key allows an attacker to redirect or inject unauthorized video content. No EPSS data was provided in the source intelligence, and no KEV listing exists, so exploitation urgency cannot be independently quantified. Severity is real but bounded: there is no confidentiality exposure (the RTMP key is overwritten, not disclosed) and no direct server availability impact, making this a targeted credential-takeover risk rather than a broadly critical infrastructure threat.

An attacker embeds a crafted img tag whose src targets the victim AVideo instance's saveLive.php endpoint with query parameters specifying a replacement RTMP key controlled by the attacker. When a logged-in AVideo streamer visits the page (via phishing or malicious ad), the browser submits the GET request with their session cookie, silently overwriting their stream credentials. The attacker then uses the captured RTMP key to inject unauthorized content into the live broadcast or prevent the legitimate streamer from publishing.