WWBN AVideo CVE-2026-86721

Exploitation requires that the target AVideo instance has the live-streaming/RTMP publishing feature active and that the saveLive.php endpoint (and related handlers) is reachable over the network. The bypass works against any per-user RTMP stream because the bypass credential ('key'='value') is a global constant, not user-specific. No authentication, account, or prior knowledge of a target's stream key is required. The limiting factor is the live-streaming feature: deployments where RTMP publishing is disabled, or where saveLive.php is inaccessible from external networks (e.g., behind a VPN or firewall allow-list), are not exploitable remotely. The vulnerability is present in the default codebase through the identified commit regardless of other configuration options.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N) accurately reflects a network-accessible, zero-complexity, no-privilege bypass targeting integrity. The attack complexity is genuinely low - the bypass credential is a single known constant cookie value, requiring no brute force or discovery. EPSS data was not provided, and the vulnerability is not in CISA KEV, so exploitation volume is unknown. Real-world impact is bounded to the RTMP live-streaming subsystem: confidentiality (private stream data) is not directly compromised, and availability is not affected. For organizations actively running AVideo live broadcasts, the risk of content injection or broadcast hijacking is high and immediate given disclosure. For deployments where live streaming is disabled or RTMP endpoints are network-restricted, exposure is substantially reduced. The product's limited deployment footprint constrains aggregate impact compared to ubiquitous infrastructure software.

An attacker browses the target AVideo instance, identifies that RTMP live streaming is enabled, and sends an HTTP POST request to /saveLive.php with the HTTP header 'Cookie: key=value'. PHP's cookie-over-request precedence causes the authentication check to accept this constant value as a valid stream key, granting the attacker full publishing rights to the targeted stream. The attacker then connects an RTMP client and streams arbitrary video content into a victim broadcaster's live channel, replacing or corrupting the legitimate broadcast with no prior account access required.