AVideo (current commit e01e41ecc and earlier) exposes stream credentials through the plugin/Live/view/Live_restreams/getLiveKey.json.php endpoint. Supplying a 'token' request parameter waives both the Live::canRestream() access gate and the restream ownership check, causing the endpoint to return any restream's stream_key and stream_url (credentials for external platforms such as YouTube, Facebook, and Twitch) without authentication. The token is merely encryptString() of an integer id with no user binding, expiry, or authentication tag. Because encryption uses AES-256-CBC with a deterministic IV and no MAC, and because intval() accepts any string beginning with a digit, an unauthenticated attacker can forge valid tokens using the public encryption oracle in view/url2Embed.json.php, disclosing arbitrary users' stream credentials.
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
AVideo installations (version e01e41ecc and earlier) suffer from an authentication bypass vulnerability that exposes streaming platform credentials through the getLiveKey.json.php endpoint. By supplying a crafted 'token' parameter, attackers can bypass access controls and retrieve stream keys and URLs for external platforms including YouTube, Facebook, and Twitch. This CVSS 8.6 vulnerability affects any organization using AVideo for live streaming operations, potentially allowing unauthorized access to broadcast accounts and enabling credential theft, stream hijacking, or unauthorized content distribution. The vulnerability is particularly dangerous because the token validation uses weak encryption (encryptString() of an integer ID), making it trivial to reverse-engineer or brute-force valid tokens.
While this CVE currently maps to zero Casky skills due to its specificity to AVideo's architecture, practitioners would detect the underlying attack pattern through behavioral analysis of authentication anomalies and credential exposure indicators. The vulnerability chain—improper input validation (CWE-347), authentication bypass, and credential disclosure—represents techniques that Casky's Claude-powered skill engine can contextualize across similar frameworks. Practitioners monitoring AVideo deployments would observe suspicious JSON endpoint requests with token parameters, abnormal access to live restream configurations, and exfiltration of stream credentials. Extended reasoning analysis would flag the logical inconsistency of unauthenticated token acceptance as a deviation from secure access control patterns, enabling detection of similar bypass vulnerabilities in custom or undocumented API endpoints.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-82645. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation