CVE-2021-35491: Wowza Streaming Engine

High severity, CVSS 8.1. EPSS: 0.9% chance of exploitation in the next 30 days.

A Cross-Site Request Forgery (CSRF) vulnerability in Wowza Streaming Engine through 4.8.11+5 allows a remote attacker to delete a user account via the /enginemanager/server/user/delete.htm userName parameter. The application does not implement a CSRF token for the GET request. This issue was resolved in Wowza Streaming Engine release 4.8.14.

Affected products

• Wowza Streaming Engine: before 4.8.14 (fixed in 4.8.14)

Published 2021-10-05. Last modified 2026-06-17.