CVE-2026-92912 WWBN CVE debrief

Who should care

Defenders responsible for AVideo configurations and LiveTransmition features should assess exposure and prioritize verification to prevent unauthorized stream key generation and broadcasting. Security teams and vulnerability management teams should also review the vulnerability and implement necessary mitigations.

Why it matters

AVideo's weak RTMP publish key generation allows attackers to brute-force stream keys and broadcast as channel owners, requiring defenders to verify configurations and restrict access.

• Attackers can brute-force stream keys and broadcast content as channel owners
• Defenders must verify AVideo configurations to prevent unauthorized stream key generation
• Restricting access to LiveTransmition features can help mitigate the vulnerability

Technical summary

AVideo uses cryptographically weak uniqid() values for RTMP publish keys in LiveTransmition, reducing key entropy to approximately one million possibilities per creation second. Attackers who know the channel creation time can brute-force the five-digit microsecond component to forge valid stream keys and broadcast content as the channel owner. This vulnerability affects AVideo's LiveTransmition feature and requires defenders to verify configurations and restrict access to prevent unauthorized stream key generation.

Defensive priority

Defenders should prioritize verifying AVideo configurations and restricting access to LiveTransmition features.

Recommended defensive actions

• Verify AVideo configurations and restrict access to LiveTransmition features
• Implement additional authentication and authorization for stream key generation
• Monitor for suspicious stream key activity and update AVideo software as needed
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE description and source references indicate that AVideo uses cryptographically weak uniqid() values for RTMP publish keys in LiveTransmition, reducing key entropy to approximately one million possibilities per creation second. Attackers who know the channel creation time can brute-force the five-digit microsecond component to forge valid stream keys and broadcast content as the channel owner. The official CVE Program record and NIST NVD detail page provide additional information on the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.