← News
/DISPATCH · 2026-08-31

AVideo Live Platform Unauthenticated Stream-Key Leak CVE-2026-82645: YouTube/Twitch/Facebook Live Credentials Can Be Stolen Arbitrarily

AVideo live restream endpoint token check fails; encryption uses AES-256-CBC with a fixed IV and no MAC. Attackers use a public encryption oracle to forge tokens and read any stream key. CVSS 4.0 9.2 Critical.

On 30 August 2026, VulnCheck and GitHub Security Advisory concurrently disclosed AVideo live platform stream-key leak CVE-2026-82645. CVSS 4.0 9.2, CVSS 3.1 8.6, CWE-347 Improper Verification of Cryptographic Signature. AVideo is an open-source video sharing and live streaming system with multi-destination restream to YouTube, Facebook, Twitch. At disclosure, commit e01e41ecc and earlier are affected. No tagged fix release. Operators must patch by hand or apply the VulnCheck fix PR.

Vulnerability Technical Details

Core is `plugin/Live/view/Live_restreams/getLiveKey.json.php`. Presence of a `token` parameter bypasses `Live::canRestream()` authorization and restream ownership checks, then returns any restream entry's `stream_key` and `stream_url` to the caller. Token generation calls AVideo `encryptString()`: AES-256-CBC of an integer ID. Key derivation is reversible. Encryption uses a fixed IV and no MAC. Worst: `view/url2Embed.json.php` is already a public encryption oracle. An attacker encrypts any integer ID into a valid token, then appends the forged token to `getLiveKey.json.php` and reads any user's YouTube/Facebook/Twitch stream keys.

Exploit Chain and Impact

Unauthenticated. No account required.

1. Hit the `url2Embed.json.php` encryption oracle; AES-256-CBC encrypt the target `liveId`; obtain a forged token. 2. Pass the token as a query parameter to `getLiveKey.json.php`; read that `liveId`'s `stream_key` and `stream_url`. 3. Paste `stream_key` into OBS, Streamlabs, vMix; impersonate the victim and stream arbitrary content to YouTube, Twitch, Facebook.

No authenticated session. No user interaction. Oracle is public, so attack traffic blends with normal traffic. In live commerce, paid courses, enterprise training, and government livestreams, stolen `stream_key` means revenue loss, brand damage, and compliance exposure. If the stolen account has VOD replay, archives, or monetization on the external platform, the attacker can wash traffic, inject ads, and plant phishing pages for further social engineering.

Impact Assessment

CWE-347 is a core signature-verification failure. Combined with a publicly callable encryption oracle, it yields a complete unauthenticated, no-interaction exploit chain. Disclosed concurrently by VulnCheck and rajivraj. Affects all maintained AVideo deployments. In live commerce, paid courses, enterprise training, and government livestreams, stolen `stream_key` causes revenue loss, brand damage, and compliance issues. If the stolen account has VOD replay, archives, or monetization on the external platform, the attacker can wash traffic, inject ads, and plant phishing pages.

Fix and Mitigation

Official fix guidance:

Temporary mitigation: block external access to `/Live_restreams/getLiveKey.json.php` at the reverse proxy/WAF; rotate all external platform stream keys immediately.

Detection: `getLiveKey.json.php` access logs; one IP pulling keys for many distinct `liveId` values in a short window; anomalous calls to the `url2Embed.json.php` encryption oracle; external platform alerts on unknown ingest sources.

References