Security Advisory

CVE-2026-85162

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-09-03 11:22:13

Last updated 2026-09-03 12:28:31

Assigner VulnCheck

CVSS score 7.1

State PUBLISHED

Description

AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in plugin/Live/saveLive.php that lacks forbidIfNotPost and forbidIfInvalidToken protections. Attackers can craft malicious image tags to overwrite authenticated streamers' RTMP keys, passwords, and titles, hijacking live broadcasts.

← Browse all CVEs View on cve.org ↗