PT-2024-22679 · Owncast · Owncast

Kevin Stubbings + 1 · Published 2024-03-20 · Updated 2025-10-14 · CVE-2024-29026

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Owncast versions 0.1.2 and prior

Description Owncast is an open source, self-hosted, decentralized, single user live video streaming and chat server. A lenient CORS policy allows attackers to make a cross origin request, reading privileged information, which can be used to leak the admin password.

Recommendations For versions 0.1.2 and prior, update to a version that includes the fix from commit 9215d9ba0f29d62201d3feea9e77dcd274581624 to resolve the issue. As a temporary workaround, consider restricting access to sensitive information until the update is applied.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-697

CWE-352

Related Identifiers

CVE-2024-29026

GHSA-V99W-R56H-G23V

GO-2024-3054

Affected Products

Owncast

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29026.json · Exploit
• 🔥 https://securitylab.github.com/advisories/GHSL-2023-261_Owncast · Exploit
• https://github.com/owncast/owncast/commit/9215d9ba0f29d62201d3feea9e77dcd274581624 · Patch
• https://osv.dev/vulnerability/CVE-2024-29026 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-3054 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-29026 · Security Note
• https://osv.dev/vulnerability/GHSA-v99w-r56h-g23v · Vendor Advisory
• https://github.com/owncast/owncast/blob/v0.1.2/router/middleware/auth.go#L32 · Note
• https://github.com/owncast/owncast · Note
• https://t.me/cvenotify/74314 · Telegram Post
• https://t.me/cveNotify/138586 · Telegram Post
• https://twitter.com/cracbot/status/1770899651270459635 · Twitter Post
• https://github.com/advisories/GHSA-v99w-r56h-g23v · Note