AVideo versions identified as =0 use the PHP uniqid() function, which produces insufficiently random values, for RTMP publish keys in the LiveTransmition feature. The entropy is limited to roughly one million possibilities per second of creation time, enabling attackers with knowledge of the channel creation timestamp to brute-force the five-digit microsecond portion of the key. This weakness allows unauthorized users to impersonate the channel owner and broadcast content by forging valid stream keys.

An attacker who can guess or know the channel creation time can brute-force the weak RTMP publish keys, potentially gaining unauthorized access to broadcast streams as the legitimate channel owner. This compromises the integrity and authenticity of live streams, allowing content spoofing or unauthorized content injection.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided. Until a fix is available, consider restricting access to channel creation times and monitoring for unauthorized broadcasts.