CVE-2026-85162
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Sep 03, 2026
Vendor
unknown
Description
AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in plugin/Live/saveLive.php that lacks forbidIfNotPost and forbidIfInvalidToken protections. Attackers can craft malicious image tags to overwrite authenticated streamers' RTMP keys, passwords, and titles, hijacking live broadcasts.