CVE-2026-89252 WWBN CVE debrief

Who should care

Defenders managing AVideo installations, especially those with canStream user accounts, should assess exposure and prioritize verification and potential updates. Defenders should prioritize verifying AVideo installations for exposure, especially those with canStream user accounts, and update to a fixed version if available. AVideo operators, platform administrators, vulnerability managers, and security teams should review the vulnerability details and take

Why it matters

AVideo's vulnerability in addLiveLink.php allows authenticated users to modify other users' links, potentially redirecting viewers to attacker-controlled media. Defenders managing AVideo installations, especially those with canStream user accounts, should assess exposure and prioritize verification and potential updates.

• Authenticated users can modify other users' LiveLinks, potentially redirecting viewers to attacker-controlled media.
• canStream users can overwrite LiveLink HLS sources and metadata, affecting content delivery.
• Verification of AVideo installations and user accounts is necessary to determine exposure.

Technical summary

AVideo's addLiveLink.php fails to verify ownership when updating LiveLinks, allowing authenticated canStream users to overwrite other users' LiveLink HLS sources and metadata. This vulnerability in AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 allows authenticated users to modify other users' links, potentially redirecting viewers to attacker-controlled media. The vulnerability allows canStream users to overwrite another user's LiveLink HLS source and metadata by supplying an existing linkId, redirecting viewers to attacker-controlled media.

Defensive priority

Defenders should prioritize verifying AVideo installations for exposure, especially those with canStream user accounts, and update to a fixed version if available.

Recommended defensive actions

• Verify AVideo installations for exposure, especially those with canStream user accounts.
• Update to a fixed version if available.
• Monitor for suspicious LiveLink updates.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but its scope and remediation require further verification from official sources. AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to verify ownership in addLiveLink.php when updating LiveLinks, allowing authenticated users to modify other users' links. The vulnerability allows canStream users to overwrite another user's LiveLink HLS source and metadata by supplying an existing linkId, redirecting viewers to attacker-controlled media. Evidence is A

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.