CVE-2026-82645: Improper Verification of Cryptographic Signature in WWBN AVideo

CVE-2026-82645 describes an improper verification of cryptographic signatures in WWBN AVideo. The plugin endpoint plugin/Live/view/Live_restreams/getLiveKey.json.php returns stream credentials if a 'token' parameter is supplied. This token bypasses access control checks but is generated using AES-256-CBC encryption with a deterministic IV and no message authentication code (MAC). Because the encryption is deterministic and lacks authentication, and the token is simply an encrypted integer ID without user binding or expiry, attackers can forge valid tokens by leveraging a public encryption oracle at view/url2Embed.json.php. This allows unauthenticated attackers to retrieve arbitrary users' stream keys and URLs, exposing sensitive credentials for external streaming platforms.

An unauthenticated attacker can bypass access controls and retrieve sensitive stream credentials (stream_key and stream_url) for any restream, potentially compromising streaming accounts on platforms such as YouTube, Facebook, and Twitch. This exposure can lead to unauthorized use or hijacking of streaming content. The vulnerability has a CVSS 4.0 score of 9.2, indicating critical severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoint and monitor for suspicious requests. Avoid relying on the current token mechanism for authentication as it is cryptographically insecure. Implement proper cryptographic signatures with authentication tags and expiry for tokens to prevent forgery.