Avideo EUVD-2026-16750

Remote unauthenticated attacker can exploit WWBN AVideo versions up to 26.0 by sending a crafted stream key parameter to the Live_schedule::keyExists() fallback method. No victim interaction required. Affects default installations with live streaming functionality enabled.

The CVSS 3.1 score of 9.1 (Critical) reflects network-accessible attack vector (AV:N), low complexity (AC:L), no privileges required (PR:N), and high impact to confidentiality and integrity (C:H/I:H/A:N). The PR:N designation confirms unauthenticated exploitation capability, making this immediately exploitable by remote attackers without credentials. The vulnerability targets RTMP authentication infrastructure, a publicly-exposed service in typical AVideo deployments, increasing real-world attack surface. No public exploit identified at time of analysis and EPSS/KEV data not provided, but the low complexity combined with unauthenticated access vector suggests high automatable exploitation potential once discovered. The absence of patches elevates urgency, as vulnerable instances remain exposed with no direct vendor remediation path. This represents a genuine high-priority risk for organizations running AVideo platforms with live streaming capabilities.

An unauthenticated remote attacker initiates an RTMP connection to the AVideo server's publish endpoint, crafting a malicious stream key containing SQL injection payloads (e.g., single quotes with UNION-based or boolean-based injection syntax). When the server validates this key through LiveTransmition::keyExists(), the fallback to the vulnerable Live_schedule::keyExists() method executes the attacker's SQL commands. The attacker extracts administrator credentials, API keys, user data from the database, or modifies live schedule configurations to hijack legitimate streaming sessions, all without requiring authentication or specialized tooling beyond standard RTMP clients.