Skip to content
Threat Feed
Subscribe
high advisory

Authentication Bypass in AVideo via Parameter Manipulation

An authentication bypass vulnerability in AVideo (CVE-2026-59808) allows attackers with upload access to hijack administrative sessions via improper video ownership verification.

CVE search metadata

CVE search record: CVE-2026-59808. Severity: high. CVSS: 8.8. KEV: no. Product: AVideo, AVideo (< 24.0), AVideo (<= e01e41ecc), AVideo (<= 29.0), AVideo (<= c91b5975d), AVideo (<= c3edcc274c), AVideo (<= c3edcc274c389816d434acadac07ee78eaf330c1). Brief: Authentication Bypass in AVideo via Parameter Manipulation. Brief link: https://feed.craftedsignal.io/briefs/2026-08-avideo-auth-bypass/

What's new

  • 1. added detection rule: Detect Unauthenticated Access to AVideo stats.json.php Sep 8, 17:45 via nvd
  • 2. added coverage for AVideo (<= c3edcc274c389816d434acadac07ee78eaf330c1) Sep 8, 17:45 via nvd
  • 3. added detection rule: Detects CVE-2026-86723 Exploitation - Unauthorized verifyChallenge.json.php Access Sep 8, 17:44 via nvd
  • 4. added detection rule: Detects CVE-2026-86721 Exploitation - Unauthorized RTMP Stream Access Sep 8, 17:43 via nvd
  • 5. added detection rule: Detects CVE-2026-85160 Exploitation - Path Traversal in stopLive.php Sep 3, 13:22 via nvd

AVideo through commit 9c39d8c8 contains a critical authentication bypass vulnerability due to flawed validation logic within the deduplicateByEncoderQueueId() and useVideoHashOrLogin() functions. The software fails to perform proper ownership verification when the videos_id parameter is omitted during an upload process, causing the system to return a video_id_hash belonging to any video, including those owned by administrators. Because the useVideoHashOrLogin() function treats this hash as a valid credential for passwordless login, an attacker can leverage a captured hash to authenticate as the video owner. This flaw allows an attacker with low-privileged upload access to escalate privileges to the administrator level, enabling full system configuration control. This vulnerability highlights the risks of implicit trust in video identifier hashes for session management.

Impact

Successful exploitation allows for full administrative account takeover within an AVideo instance. Attackers can modify system configurations, manage user accounts, and potentially gain access to sensitive media content. This is particularly critical for enterprise or public-facing video platforms where AVideo is used to manage high-privileged administrative accounts.

Recommendation

  • Apply patches or upgrade AVideo instances to a version beyond commit 9c39d8c8 to address the logic error in ownership verification.
  • Monitor web server logs for anomalous POST or GET requests to upload endpoints where the videos_id parameter is absent or manipulated.
  • Audit current AVideo session management logs for unusual passwordless login patterns involving video_id_hash parameters.

Immediate actions

Upgrade AVideo beyond commit 9c39d8c8 to resolve CVE-2026-59808.

IT Operations 48h

Mitigations

Monitor administrative session logs for unauthorized passwordless authentication attempts.

immediate SOC

CVE-2026-59808

Detection coverage 7

Detect CVE-2026-82645 Exploitation Attempt - Unauthorized Access to GetLiveKey

high

Detects unauthorized attempts to access the getLiveKey.json.php endpoint by monitoring for anomalous requests that bypass standard authentication flows, specifically targeting the restream credential extraction endpoint.

sigma tactics: credential_access, initial_access techniques: T1552.001 sources: webserver

Detects CVE-2026-84187 Exploitation - Unauthenticated Broadcast Manipulation

high

Detects unauthorized attempts to access the AVideo Live plugin callback endpoint for broadcast status modification.

sigma tactics: impact techniques: T1565.002 sources: webserver

Detects CVE-2026-84208 Exploitation - SQL Injection in User_Location Plugin

high

Detects exploitation attempts targeting CVE-2026-84208 by identifying SQL syntax in GET parameters sent to AVideo User_Location plugin endpoints.

sigma tactics: initial_access techniques: T1190 sources: webserver

Detects CVE-2026-85160 Exploitation - Path Traversal in stopLive.php

high

Detects attempts to exploit the path traversal vulnerability in stopLive.php by identifying directory traversal sequences in the 'key' parameter

sigma tactics: initial_access techniques: T1190 sources: webserver

Detects CVE-2026-86721 Exploitation - Unauthorized RTMP Stream Access

high

Detects attempts to exploit CVE-2026-86721 by monitoring for requests to saveLive.php containing the specific 'key' cookie used for authorization bypass.

sigma tactics: initial_access techniques: T1565.001 sources: webserver

Detects CVE-2026-86723 Exploitation - Unauthorized verifyChallenge.json.php Access

high

Detects potential exploitation attempts of CVE-2026-86723 by identifying requests to verifyChallenge.json.php that result in 200 OK status but involve unusual or empty request parameters.

sigma tactics: initial_access, persistence techniques: T1190 sources: webserver

Detect Unauthenticated Access to AVideo stats.json.php

high

Detects HTTP GET requests to the vulnerable AVideo stats.json.php endpoint which may be used to exfiltrate private stream metadata.

sigma tactics: reconnaissance techniques: T1592 sources: webserver

Detection queries are available on the platform. Get full rules →