Security readout for executives and security teams
Plain-English summary
A flaw in AVideo can let an unauthenticated internet user obtain livestream credentials belonging to other users. Those credentials may provide access to external streaming platforms, creating risks of account misuse, disrupted broadcasts, reputational harm, and credential exposure beyond the AVideo system.
Executive priority
Treat as an immediate remediation priority for internet-accessible AVideo systems. Determine exposure, restrict vulnerable endpoints, rotate potentially disclosed stream credentials, and monitor connected streaming accounts. Lack of confirmed exploitation does not materially reduce urgency because exploitation is unauthenticated and low complexity.
Technical view
The Live restream endpoint accepts a forgeable token that bypasses authorization and ownership checks. Tokens encrypt an integer identifier using deterministic AES-256-CBC without authentication, user binding, or expiry. A public encryption oracle and permissive integer parsing enable disclosure of arbitrary restream stream keys and URLs.
Likely exposure
AVideo deployments at commit e01e41ecc or earlier may be exposed when the affected Live plugin endpoints are reachable by untrusted users. The sources provide no product version or CPE mapping, so administrators must assess exposure by deployed commit and configuration.
Exploitation context
Exploitation requires no authentication, privileges, or user interaction and has low stated complexity. The supplied record is not listed in KEV, and the provided sources do not establish active exploitation in the wild. Public technical advisories may increase discovery and targeting risk.
Researcher notes
The weakness is classified as CWE-347. Its impact arises from combining unauthenticated token acceptance, missing ownership enforcement, unauthenticated CBC encryption, deterministic IV use, permissive integer conversion, and a public encryption oracle. Exact fixed versions and evidence of exploitation are absent from the supplied materials.
Mitigation direction
- Check the vendor advisory immediately for an official patched commit or updated release.
- Restrict untrusted access to the affected Live restream and URL embedding endpoints until remediated.
- Rotate external-platform stream keys that the vulnerable AVideo deployment stored or could disclose.
- Review YouTube, Facebook, Twitch, and other connected platforms for unauthorized streaming activity.
Validation and detection
- Identify all AVideo instances and record their deployed commits and Live plugin exposure.
- Confirm whether affected endpoints are reachable from the internet or other untrusted networks.
- Review web logs for suspicious requests targeting both named endpoints and unusual restream identifiers.
- Verify rotated stream credentials no longer authorize access on connected external platforms.
- After remediation, confirm authorization and ownership checks apply to every restream credential request.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-347: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-82645 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.2 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N——VulnCheckCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N3.94VulnCheckVulnerability scoring details
Base CVSS 4.0 score
9.2CriticalVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Base CVSS 3.1 score
8.6HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- GitHub Security Advisory (GHSA-c4w3-h888-7ccv)CVE reference, VulnCheck · vendor-advisory
- VulnCheck Advisory: AVideo Unauthenticated Stream Credential Disclosure via Forgeable TokenCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Verification of Cryptographic Signature
Improper Verification of Cryptographic Signature represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.