CVE-2026-82645 WWBN CVE debrief

Who should care

Organizations using AVideo, particularly those with publicly accessible instances, should prioritize patching this vulnerability to prevent potential credential disclosure. This is crucial for maintaining the security of their streaming services and protecting sensitive information. The vulnerability's critical severity, with a CVSS score of 9.2, underscores the importance of immediate action to mitigate the risk of credential disclosure and potential exploitation by attackers.

Technical summary

AVideo exposes stream credentials through the plugin/Live/view/Live_restreams/getLiveKey.json.php endpoint. An unauthenticated attacker can forge valid tokens using the public encryption oracle in view/url2Embed.json.php, disclosing arbitrary users' stream credentials. This vulnerability stems from the insecure use of AES-256-CBC with a deterministic IV and no MAC for token encryption, along with the lack of user binding, expiry, or authentication tag. The token is generated by merely encrypting an integer id with no additional security measures, making it susceptible to forgery.

Defensive priority

Organizations using AVideo should prioritize patching this vulnerability to prevent potential credential disclosure.

Recommended defensive actions

• Review and apply the patch for AVideo to fix the stream credential disclosure vulnerability
• Restrict access to the affected endpoint
• Monitor for potential exploitation attempts
• Consider implementing additional security measures to protect stream credentials
• Perform a thorough review of the system to identify any potential weaknesses
• Ensure that all instances of AVideo are updated with the latest security patches
• Continuously monitor the system for any suspicious activity

Evidence notes

The CVE description indicates that AVideo exposes stream credentials through an endpoint without proper authentication, allowing an unauthenticated attacker to forge valid tokens and disclose arbitrary users' stream credentials. This issue arises from the use of a deterministic IV and no MAC in the encryption, combined with the lack of user binding, expiry, or authentication tag in the token. To verify and mitigate this vulnerability, defenders should review the affected endpoint, assess current exposure, and apply the patch provided by the vendor. They should also monitor for potential exploitation attempts and consider implementing additional security measures to protect stream credentials.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.