CVE-2026-85162: Cross-Site Request Forgery (CSRF) in WWBN AVideo
Description
AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in plugin/Live/saveLive.php that lacks forbidIfNotPost and forbidIfInvalidToken protections. Attackers can craft malicious image tags to overwrite authenticated streamers' RTMP keys, passwords, and titles, hijacking live broadcasts.
CVSS v4.0
Score 7.1high
Affected software
WWBN
AVideo
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
WWBN AVideo contains a CSRF vulnerability in the plugin/Live/saveLive.php file due to missing request validation protections (forbidIfNotPost and forbidIfInvalidToken). This allows attackers to perform unauthorized state-changing actions by tricking authenticated users into loading malicious image tags. The impact includes overwriting RTMP keys, passwords, and broadcast titles, enabling hijacking of live streams. The vulnerability is tracked as CVE-2026-85162 with a CVSS 4.0 base score of 7.1 (high severity). No vendor patch or mitigation details are currently available.
Potential Impact
Successful exploitation can lead to hijacking of live broadcasts by overwriting critical streamer credentials such as RTMP keys and passwords. This compromises the integrity and availability of live streaming sessions for authenticated users.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when interacting with untrusted content that could trigger CSRF attacks. Implementing additional CSRF protections such as verifying POST requests and validating tokens on the affected endpoint is recommended if possible.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-03T11:04:41.807Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a995c08acd9273b49dbb69d
Added to database: 09/03/2026, 11:37:44 UTC
Last enriched: 09/07/2026, 13:17:46 UTC
Last updated: 10/18/2026, 18:48:24 UTC
Views: 69
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.