Description

AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in plugin/Live/saveLive.php that lacks forbidIfNotPost and forbidIfInvalidToken protections. Attackers can craft malicious image tags to overwrite authenticated streamers' RTMP keys, passwords, and titles, hijacking live broadcasts.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-03T13:06:23.270Z",
  "pubdate": "2026-09-03T13:06:23.270Z",
  "executiveSummary": "AVideo, in versions up to commit c91b5975d, is susceptible to a critical Cross-Site Request Forgery (CSRF) vulnerability located within the plugin/Live/saveLive.php script.\nThe vulnerability arises from the absence of essential security enforcement mechanisms, specifically the lack of forbidIfNotPost and forbidIfInvalidToken checks, which are required to validate the authenticity of incoming requests.\nBy leveraging this flaw, an unauthenticated attacker can coerce an authenticated user into unknowingly executing unauthorized state-changing operations.\nThe primary impact is the unauthorized modification of critical streamer configuration parameters, including RTMP keys, account passwords, and live stream titles.\nThis allows an attacker to hijack active broadcasts or gain persistent unauthorized control over a user's streaming infrastructure.\nThe exploit can be triggered via malicious image tags or similar cross-site vectors, requiring only that an authenticated streamer visit a crafted malicious page.\nGiven the nature of the application, this flaw represents a significant risk to the integrity of user accounts and the confidentiality of live broadcasting sessions.",
  "technicalDetails": "The vulnerability exists in the plugin/Live/saveLive.php script, which processes requests to update live stream configurations.\nRoot cause analysis identifies a failure to implement proper request verification tokens (CSRF tokens) or enforce HTTP POST request methods via the application's internal security functions: forbidIfNotPost() and forbidIfInvalidToken().\nBecause the application processes parameters without validating the intent of the sender, it treats requests initiated via GET (or other methods) as legitimate if the session cookie is present in the user's browser.\nAn attacker can exploit this by injecting a specially crafted HTML image tag or an auto-submitting form into a third-party website visited by the victim. The src attribute of an image tag, for example, can be pointed to the vulnerable URL with query parameters containing the new, attacker-controlled values for the streamer's configuration.\nWhen an authenticated administrator or streamer views the attacker's page, the browser automatically includes the user's session credentials (cookies) in the request to the AVideo server.\nThe server-side code in saveLive.php accepts these forged parameters, updates the underlying database with the attacker's supplied data, and effectively overwrites the existing RTMP stream key and password credentials.\nOnce the RTMP key has been overwritten, the attacker can use the new credentials to authenticate to the streaming server, allowing them to broadcast unauthorized content under the victim's account.\nFurthermore, the ability to modify the stream title allows for social engineering or content misrepresentation. Since the vulnerability does not require complex payloads, the attack vector is limited only by the attacker's ability to deliver the request to an active user session.\nThe exploitation does not require prior knowledge of the victim's password, as the application assumes that any request bearing the victim's session cookie is legitimate. This bypasses the intended access control logic, resulting in complete unauthorized control over the streaming settings."
}