Multiple High-Risk Vulnerabilities in AVideo Expose Streaming Credentials

• •AVideo has multiple critical vulnerabilities allowing unauthorized access to live streams.
• •Attackers can exploit session cookies and unsecured endpoints to hijack broadcasts.
• •Urgent remediation is required, including applying patches and restricting access.

AVideo has reported several critical vulnerabilities affecting its live streaming platform, primarily through authorization bypass and information disclosure flaws. The vulnerabilities, identified as CVE-2026-86720, CVE-2026-86721, CVE-2026-86727, and CVE-2026-86728, allow attackers to hijack live streams and access sensitive credentials without authentication. Affected systems include internet-facing AVideo installations, particularly those allowing self-service registration or hosting private content. Attack vectors include manipulating session cookies and accessing unsecured endpoints, making exploitation relatively straightforward. The vendor has issued urgent remediation recommendations, including applying security patches and restricting access to sensitive functions. Current assessments indicate a high risk of exploitation, with proof-of-concept code available for some vulnerabilities. Organizations using AVideo for live streaming are advised to take immediate action to mitigate these risks.