CVE-2026-61569
HighCVSS 7.5Summary
In AVideo before 8.1.0, the unauthenticated streamer login at `objects/login.json.php` passes the `user` parameter to `Streamer::get`, where it is interpolated into a single-quoted MariaDB SELECT without parameterization or escaping. Although `objects/security.php` strips literal single quotes, `html_entity_decode` in `objects/Login.php` restores entity-encoded quotes before the query. UNION results are exposed through `streamers_id`, while failures return the rendered query and MariaDB error. This is fixed in version 8.1.0.
Risk Assessment
An attacker can read arbitrary encoder database data, including stored upstream streamer credentials, allowlist configuration, and queue records, without encoder credentials. Stolen streamer credentials can provide continued upstream access until rotated.
Recommendation
Update AVideo to version 8.1.0 or later. After updating, consider rotating streamer credentials and reviewing the allowlist configuration.
Other vulnerabilities in AVideo
See all- CVE-2026-61575Medium
Prior to 8.1.0, AVideo's view/queue.php uses pathinfo on the caller-controlled fileURI and stores its filename through setTitle in encoder_queue.title without neutralization. fileURI is not covered by the objects/security.php filter lists, and the Login::canUpload() capability can be self-granted, allowing an attacker to store an HTML title whose event handler runs in a privileged viewer's browser (an administrator or an operator on the attacker's streamer).
- CVE-2026-61573Medium
Prior to 8.1.0, AVideo's anonymous login interface reflects request values into HTML and JavaScript without output encoding. webSiteRootURL is returned verbatim by Streamer::getStreamerURL() and reaches navigation and form attributes as well as a JavaScript string in view/index.header.php, while the user and pass fields are filtered only for single quotes, allowing double quotes and angle brackets to break out of HTML attributes. Additionally, view/index.header.php reflects POST fields using json_encode without JSON_HEX_TAG, and locale/function.php stores the POST lang value in the session for unescaped reflection.
- CVE-2026-61572High
An SSRF vulnerability in AVideo (before version 8.1.0) allows an unauthenticated remote attacker to read responses from internal HTTP/HTTPS and FTP services. The `url_get_contents` function does not reject private, loopback, or link-local addresses and disables TLS peer verification, while the `objects/login.json.php` endpoint returns the fetched body. Additionally, `view/youtubeDl.json.php` enables requests to internal FTP servers.
- CVE-2026-61571High
In AVideo before 8.1.0, the encoder lacks a global authentication layer and exposes control and status PHP endpoints to anonymous network callers. The endpoints `view/run.php`, `view/queue.json.php`, `view/status.php`, and `view/listFiles.json.php` allow an unauthenticated attacker to drive the privileged queue processor, read queue and streamer-site information, obtain memory statistics, and enumerate media file names and paths in any directory readable by the web-server user. This is fixed in version 8.1.0.
- CVE-2026-89255High
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LoginControl plugin that fails to HTML-encode PGP public keys echoed into a textarea element. An authenticated attacker can inject malicious JavaScript by submitting a crafted public key, which executes in an administrator's session when viewing the user's profile tab.
- CVE-2026-89253High
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the user 'donationLink' profile field. User::setDonationLink() stores the value and save() validates it only with filter_var(..., FILTER_VALIDATE_URL), which accepts strings such as http://evil.example/"onmouseover=alert(document.domain)//, while getDonationLink() applies only strip_tags() and does not encode double quotes. An authenticated user who updates their own profile can break out of the href attribute and inject an event handler that executes JavaScript in the browser of any visitor, including an administrator.
- CVE-2026-89250High
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an unauthenticated file read vulnerability in the getRecordedFile.php endpoint that streams recorded FLV files from the temporary directory. Attackers can request the endpoint with a known or guessed stream key to download recorded live video files without authentication or authorization checks.
- CVE-2026-89248Medium
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 is missing an authentication/authorization check in plugin/WebRTC/status.json.php. When the WebRTC plugin is present, any unauthenticated remote user can request the endpoint and receive JSON containing the absolute filesystem path of the WebRTC2RTMP helper binary, the configured WebRTC port, file_exists/is_executable status, log contents, and port reachability information.
- CVE-2026-89245Medium
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in playlistRemove.php that allows attackers to delete playlists by skipping CSRF protection checks. Attackers can craft a malicious form that submits a POST request to playlistRemove.php.
- CVE-2026-89240Medium
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Live/confirmLivePassword.php. The unauthenticated GET parameter u is interpolated directly into an img src attribute without URL- or HTML-encoding, allowing injection of an additional tag with an onerror handler.
Original NVD description (English source)
AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated streamer login at `objects/login.json.php` passes the `user` parameter to `Streamer::get` in `objects/Streamer.php`, where it is interpolated into a single-quoted MariaDB SELECT without parameterization or escaping. Although `objects/security.php` strips literal single quotes, `html_entity_decode` in `objects/Login.php` restores entity-encoded quotes before the query. The supplied `siteURL` must pass the streamer allowlist, which allows all sites when empty by default, and an attacker-hosted login response must set `canUpload` or `isAdmin` to reach `Streamer::createIfNotExists`. That function calls `Streamer::get` before its additional allowlist check. UNION results are exposed through `streamers_id`, while failures return the rendered query and MariaDB error. An attacker can read arbitrary encoder database data, including stored upstream streamer credentials, allowlist configuration, and queue records, without encoder credentials. Stacked statements are not permitted by the mysqli driver and the tested database account lacks global FILE privilege, so the demonstrated vector is bounded to reads rather than server-side file writes. Stolen streamer credentials can provide continued upstream access until rotated. This issue is fixed in version 8.1.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS