CVE-2026-85162: Wwbn Avideo

Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days.

AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in plugin/Live/saveLive.php that lacks forbidIfNotPost and forbidIfInvalidToken protections. Attackers can craft malicious image tags to overwrite authenticated streamers' RTMP keys, passwords, and titles, hijacking live broadcasts.

Affected products

• Wwbn Avideo

Published 2026-09-03. Last modified 2026-09-08.