---
id: CVE-2026-84187
title: >-
  AVideo contains a missing authentication vulnerability in
  plugin/Live/on_publish.php that allows unauthenticated attackers to mark
  arbitrary scheduled broadcasts as failed by sending crafted POST requests with
  schedule identifiers
summary: >-
  AVideo contains a missing authentication vulnerability in
  plugin/Live/on_publish.php that allows unauthenticated attackers to mark
  arbitrary scheduled broadcasts as failed by sending crafted POST requests with
  schedule identifiers. Attac…
severity: high
cvss: 8.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H'
cwe:
  - CWE-284
published: '2026-09-01'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T20:18:59.270'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-84187'
references:
  - url: 'https://github.com/WWBN/AVideo/security/advisories/GHSA-v395-2xmq-cg23'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/avideo-on-publish-php-missing-authentication-check-via-rtmp-callback
    label: disclosure@vulncheck.com
  - url: 'https://github.com/WWBN/AVideo/security/advisories/GHSA-v395-2xmq-cg23'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00349
epssPercentile: 0.28581
ingestedAt: '2026-09-08T21:11:12.288Z'
---

## Overview

AVideo contains a missing authentication vulnerability in plugin/Live/on_publish.php that allows unauthenticated attackers to mark arbitrary scheduled broadcasts as failed by sending crafted POST requests with schedule identifiers. Attackers can exploit the unguarded RTMP callback endpoint to modify scheduled broadcast status fields by supplying fabricated stream keys matching the pattern -ps-<N>, silently canceling any scheduled live broadcast without credentials or authorization.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.