AVideo EUVD-2026-81434

Exploitation requires AVideo's live streaming (LiveTransmition / RTMP publishing) feature to be in use, and the attacker must know or accurately estimate the target channel's creation timestamp to seed the brute-force. The forgeable value is the five-digit microsecond component of a weak uniqid() call, giving roughly one million candidates per creation-second. Limiting factors: knowledge of channel creation time is a real prerequisite (reflected as AC:H/AT:P), the brute-force must succeed against server-side RTMP acceptance, and impact is confined to publishing content as the channel owner (integrity), not full account takeover or data exfiltration.

This is a genuine, well-scoped integrity issue rather than a high-CVSS paper tiger, but the raw 8.3 CVSS 4.0 (vendor) overstates ease of exploitation. The vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N is network-reachable and pre-auth (PR:N), yet AC:H plus AT:P correctly capture two real gating conditions: the attacker must first learn the target channel's creation time, then brute-force the five-digit microsecond component of a weak uniqid() value (~1,000,000 possibilities per creation-second). No EPSS score, no CISA KEV listing, and no public POC were provided - only a VulnCheck advisory and vendor GHSA. There is no active-exploitation signal, so this is not a drop-everything emergency; it warrants prompt patching where AVideo hosts live RTMP publishing. One notable data conflict: the input Tags label this 'Information Disclosure,' but the vendor's own 4.0 vector and the described impact (broadcasting content as the channel owner) are integrity-driven (VI:H), with only marginal confidentiality relevance - the tag is mislabeled. Overall a real-but-conditional priority; the AC:H timing/brute-force requirement is the main dampener on real-world exploitability.

An attacker who can observe or infer when a victim's AVideo channel was created narrows the RTMP publish key to the roughly one million microsecond-derived values generated in that creation-second, then brute-forces the five-digit component to reconstruct a valid stream key. With the forged key, the attacker publishes an RTMP stream that AVideo accepts as the legitimate channel owner, broadcasting arbitrary content under the victim's identity. No public exploit code was identified at time of analysis; only a VulnCheck advisory documents the weakness.