External risk intelligence

WWBN AVideo Stream Key SQL Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-34374

AVideo is an open-source video platform designed to be a public-facing web application. This vulnerability exists within the RTMP publish authentication path, which is a core service component typically exposed to the internet to allow remote streamers to connect and broadcast content.

SQL Injection

Wwbn Avideo

26.0 and earlier

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a critical vulnerability in the WWBN AVideo platform, an open-source video solution. The issue lies in how the system handles stream keys, potentially allowing attackers to manipulate database queries. While no fix is currently available, the nature of the vulnerability raises concerns about unauthorized access and data manipulation if the platform is exposed to the internet.

Allows unauthorized database manipulation.
Critical for public-facing video platforms.
Confirm relevance and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this by sending a specially crafted stream key during RTMP publish authentication. This would bypass the platform's usual security checks and allow them to interact with the underlying database. If successful, this could lead to unauthorized access to and manipulation of sensitive data within the video platform.

No authentication is required.
A specific stream key triggers the flaw.
Leads to SQL injection and data compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to inject malicious SQL code into the platform. This could lead to unauthorized access to or modification of video scheduling data and potentially impact the integrity of the platform's services when used for RTMP publish authentication.

Video scheduling data.
SQL injection during RTMP publish authentication.
Unauthorized access or modification of data.

Operational Fix

Recommended remediation, mitigation, and detection steps

The WWBN AVideo platform's core RTMP publish authentication is susceptible to SQL injection due to a fallback method that bypasses parameterization. Given that no patched versions are available, the immediate practical step is to identify all instances of WWBN AVideo, determine their exposure and business criticality, and then ascertain the accountable owner for potential mitigation or risk reduction strategies.

Platform or application owners should address this.
Verify public accessibility and criticality.
Plan temporary risk reduction measures.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is WWBN AVideo?

WWBN AVideo is an open-source software platform used to host and stream video content. It functions as a web-based system where users can broadcast and manage live or recorded media. Because it is designed to handle video distribution, it includes core services like RTMP, which allows external broadcasters to connect their equipment to the server to stream live video to an audience.

What does CVE-2026-34374 mean for the software?

This vulnerability is a SQL injection, classified as CWE-89. It happens when the software takes user-provided input and inserts it directly into a database command without proper sanitization. In this specific case, the flaw exists in a fallback function that handles authentication for video streams, allowing attackers to interfere with how the system talks to its database.

How is this vulnerability triggered?

The flaw is triggered by sending a specially crafted stream key during the RTMP publish authentication process. It specifically occurs when the system fails to find a match in its primary, secure search and moves to a fallback method that does not use parameterization. It is not triggered by standard video playback; the risk is isolated to the authentication path used by broadcasters.

Why should I care if my AVideo instance is internet-facing?

According to Halo Surface Signal, AVideo is typically deployed as a public-facing application because it must be accessible to remote streamers. If your instance is reachable over the internet, an unauthenticated attacker can attempt to exploit this flaw without needing a login. This exposes the database to potential unauthorized access or modification since the entry point is core to the platform's public services.

What should I do if I am running AVideo?

Since there is no software patch currently available, your first step is to locate all deployments of AVideo within your environment and identify who is responsible for them. Assess whether these instances need to be exposed to the public internet and evaluate the business impact of the data they hold. You should work with your team to plan temporary risk reduction strategies while waiting for a fix from the developers.

References

github.com/WWBN/AVideo/security/advisories/GHSA-xgv5-66wp-ch88

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.