External risk intelligence

AVideo Unauthenticated Stream Credential Disclosure via Forgeable Token.

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-82645

AVideo is a web-based video platform typically deployed as an internet-facing application to allow users to view streams and content. The vulnerability resides in a web endpoint reachable via standard HTTP requests, which is commonly exposed to the public internet in standard deployment patterns for video streaming services.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This critical vulnerability in AVideo allows unauthenticated attackers to access sensitive stream credentials, such as those for YouTube, Facebook, and Twitch, by forging a specific token. The exposure of these credentials could potentially lead to unauthorized use of streaming services or further compromise of user accounts.

Unauthenticated access to stream credentials.
External exposure of credentials impacts streaming services.
Verify if this video platform is in use.

Attack Path

How an attacker could exploit the issue

An attacker can forge a token to bypass authentication and access stream credentials from the AVideo platform. This is achieved by exploiting a public encryption oracle to create a valid token that grants access to sensitive information, such as stream keys and URLs for external platforms like YouTube, Facebook, and Twitch, without requiring any user authentication or special privileges.

No authentication needed.
Forge token via public encryption.
Discloses stream credentials.

Live Threat

Current exploitation, exposure, and threat context

AVideo's Live streaming feature could expose credentials for external platforms like YouTube, Facebook, and Twitch. This occurs when an unauthenticated attacker crafts a specific request to an endpoint that bypasses access controls and ownership checks, allowing disclosure of any restream's stream key and URL. The vulnerability is present when the AVideo application is accessible, and an attacker can interact with the vulnerable endpoint.

Stream credentials for external platforms.
Forging tokens to access the endpoint.
Unauthorized use of streaming services.

Operational Fix

Recommended remediation, mitigation, and detection steps

System owners and application teams are likely responsible for addressing this vulnerability in AVideo, as it exposes sensitive stream credentials through a web endpoint. The first practical step is to identify all instances of AVideo, determine their reachability and business criticality, and then confirm the accountable owner for remediation.

Identify AVideo deployment owners.
Verify external exposure and criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is AVideo?

AVideo is an open-source, web-based video platform designed for hosting, managing, and broadcasting live and on-demand video content. It functions as a comprehensive media server, allowing administrators to configure live streaming capabilities and integrate with third-party social platforms like YouTube, Facebook, and Twitch to broadcast video simultaneously. Organizations use it to build their own custom video streaming infrastructure.

What is the CVE-2026-82645 weakness class?

This vulnerability is classified as Improper Verification of Cryptographic Signature (CWE-347). In this specific case, the software uses a weak encryption method to generate access tokens without validating them correctly. Because the process is predictable, an attacker can create their own forged tokens that the application mistakenly accepts as legitimate, allowing them to bypass security checks and view restricted data.

How does an attacker trigger this vulnerability?

An attacker triggers this by interacting with a specific public endpoint in AVideo designed to encode data. By submitting input to this endpoint, they can generate valid-looking tokens without needing a password. They then supply these forged tokens to the live streaming configuration endpoint. The system does not verify the token's authenticity, so it treats the request as authorized and reveals sensitive stream keys. Simply visiting the site as a regular user does not trigger this.

Why is this a concern for my AVideo instance?

According to Halo Surface Signal, AVideo is typically deployed as an internet-facing application to support public video viewing. This means the vulnerable endpoint is likely reachable by anyone on the internet. If your instance is exposed, an attacker does not need special permissions or internal network access to potentially steal the keys used to broadcast your video content to external services, which could lead to unauthorized streaming.

What should I do if I run AVideo?

Start by identifying all instances of AVideo within your infrastructure to understand the scope of potential exposure. Once identified, evaluate whether these instances are accessible from the public internet. Coordinate with the teams responsible for these systems to confirm the current version and determine if they are impacted by this flaw. Prioritize checking platforms that handle sensitive third-party streaming credentials.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.