CVE-2026-86721: Wwbn Avideo

High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days.

AVideo through commit c3edcc274c contains an authorization bypass vulnerability where a session cookie named 'key' with value 'value' overrides the $_REQUEST['key'] parameter in saveLive.php and related endpoints. Attackers can publish to any user's RTMP stream without authentication by using the known constant stream key value to hijack live broadcasts.

Affected products

• Wwbn Avideo

Published 2026-09-08. Last modified 2026-09-19.