Description

AVideo (current commit e01e41ecc and earlier) exposes stream credentials through the plugin/Live/view/Live_restreams/getLiveKey.json.php endpoint. Supplying a 'token' request parameter waives both the Live::canRestream() access gate and the restream ownership check, causing the endpoint to return any restream's stream_key and stream_url (credentials for external platforms such as YouTube, Facebook, and Twitch) without authentication. The token is merely encryptString() of an integer id with no user binding, expiry, or authentication tag. Because encryption uses AES-256-CBC with a deterministic IV and no MAC, and because intval() accepts any string beginning with a digit, an unauthenticated attacker can forge valid tokens using the public encryption oracle in view/url2Embed.json.php, disclosing arbitrary users' stream credentials.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.6",
  "pubDate": "2026-08-30T15:16:44.863Z",
  "pubdate": "2026-08-30T15:16:44.863Z",
  "executiveSummary": "AVideo (commit e01e41ecc and earlier) contains a critical vulnerability in the plugin/Live/view/Live_restreams/getLiveKey.json.php endpoint, allowing unauthenticated attackers to exfiltrate sensitive stream credentials.\nThe vulnerability is characterized by a broken access control mechanism and a flawed cryptographic implementation.\nBy supplying a forged 'token' parameter, an attacker can bypass authorization gates, including Live::canRestream() and ownership verification checks, to retrieve stream_key and stream_url data for external platforms like YouTube, Facebook, and Twitch.\nThe risk is exacerbated by the use of deterministic encryption (AES-256-CBC with a static IV) and the absence of a Message Authentication Code (MAC), allowing attackers to utilize the public encryption oracle located at view/url2Embed.json.php.\nThis flaw allows unauthorized access to private third-party streaming credentials, leading to full account takeover of restreaming services and potential unauthorized content broadcasting. The vulnerability requires no authentication and can be exploited over the network by any remote attacker.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper handling of the 'token' request parameter within the plugin/Live/view/Live_restreams/getLiveKey.json.php endpoint. The application relies on an insecure implementation of encryptString() for authentication, where tokens are generated by encrypting an integer ID without any associated user binding, timestamp-based expiry, or cryptographic integrity protection.\nThe cryptographic implementation uses AES-256-CBC with a deterministic IV and lacks a MAC (Message Authentication Code), rendering the scheme vulnerable to cryptographic attacks. Because the encryption oracle at view/url2Embed.json.php is publicly accessible, an attacker can encrypt arbitrary integer values to generate valid tokens. Given that the PHP intval() function processes strings starting with a digit, an attacker can easily bypass the underlying logic checks.\nThe exploitation flow is as follows: 1) An attacker identifies the target restream ID; 2) The attacker submits the target ID to the public encryption oracle at view/url2Embed.json.php to generate a legitimate, encrypted 'token'; 3) The attacker sends a GET request to plugin/Live/view/Live_restreams/getLiveKey.json.php, including the forged token as a parameter. 4) The endpoint fails to validate the user context or the integrity of the token, subsequently waiving the Live::canRestream() check and the ownership verification. 5) The server returns the sensitive stream_key and stream_url associated with the restream ID, effectively leaking the victim's external streaming credentials.\nThis vulnerability is present in AVideo current commit e01e41ecc and all prior versions. The exposure is unrestricted, as the endpoint is exposed over the network without requiring any prior authentication or established session privileges. Post-exploitation impact is severe, as it grants attackers the ability to hijack third-party streaming sessions, potentially compromising the integrity of external social media and streaming accounts linked to the AVideo instance."
}