CVE-2016-20035: Wowza Streaming Engine 4.5.0 CSRF via user edit endpoint

Security readout for executives and security teams

Wowza Streaming Engine 4.5.0 has a CSRF flaw in an administrative user-edit function. If an administrator is already logged in and visits a malicious page, unwanted administrative changes may occur, including creation of new admin accounts. This is not listed in CISA KEV, so active exploitation is not established from the supplied sources. Exposure is most relevant where Wowza Streaming Engine 4.5.0 administrative consoles are used by browser-based administrators. Risk increases if admins browse untrusted sites while authenticated or if the management interface is broadly reachable. Treat as a targeted administrative-risk issue. Prioritize if Wowza 4.5.0 manages business-critical streaming services or the admin console is reachable beyond trusted networks. Validate exposure and seek vendor guidance promptly. Mitigation focus: Identify any Wowza Streaming Engine 4.5.0 deployments.; Check Wowza vendor guidance for patches, upgrades, or configuration recommendations.; Restrict management interface access to trusted networks or VPN..

Prepared

Apr 30, 2026, 01:34 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.