Description
AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in plugin/Live/saveLive.php that lacks forbidIfNotPost and forbidIfInvalidToken protections. Attackers can craft malicious image tags to overwrite authenticated streamers' RTMP keys, passwords, and titles, hijacking live broadcasts.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| WWBN | AVideo | — | — |
References
- GitHub Security Advisory (GHSA-6jj8-2953-6frf) vendor-advisory
- VulnCheck Advisory: AVideo through c91b5975d CSRF via saveLive.php third-party-advisory