CyberRota Analysis
AI-GeneratedAVideo versions up to 29.0 are vulnerable due to an information disclosure flaw in the restreamsActive.json.php endpoint, which allows authenticated streamers to access the source stream keys and identities of all other active streamers. This vulnerability can lead to unauthorized exposure of sensitive credentials and streamer identities, compromising the privacy of all users with streaming capabilities. Organizations utilizing AVideo should prioritize patching this issue to protect their streamers' sensitive information from potential misuse.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
AVideo through 29.0 contains an information disclosure vulnerability in restreamsActive.json.php that allows authenticated streamers to enumerate source stream keys and identities of all other streamers' active restreams. The endpoint fails to filter results by user ownership, exposing sensitive transmission credentials and streamer identity across all accounts to any user with streaming capability.