CyberRota Analysis
AI-GeneratedAVideo is vulnerable due to an authorization bypass that allows attackers to exploit a session cookie to override critical parameters in the saveLive.php endpoint. This flaw enables unauthorized users to publish to any user's RTMP stream, effectively hijacking live broadcasts. Organizations using AVideo should prioritize immediate remediation to prevent unauthorized access and potential misuse of their streaming services.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
AVideo through commit c3edcc274c contains an authorization bypass vulnerability where a session cookie named 'key' with value 'value' overrides the $_REQUEST['key'] parameter in saveLive.php and related endpoints. Attackers can publish to any user's RTMP stream without authentication by using the known constant stream key value to hijack live broadcasts.