CVE-2026-85162 — AVideo through c91b5975d CSRF via saveLive.php
AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in plugin/Live/saveLive.php that lacks forbidIfNotPost and forbidIfInvalidToken protections. …
Published: 2026-09-03 · CVSS: 7.1 · CVSS 4.0
AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in plugin/Live/saveLive.php that lacks forbidIfNotPost and forbidIfInvalidToken protections. Attackers can craft malicious image tags to overwrite authenticated streamers' RTMP keys, passwords, and titles, hijacking live broadcasts.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7