PT-2026-25732 · Wowza · Streaming Engine

Published 2026-03-15 · Updated 2026-03-16 · CVE-2016-20034

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Wowza Streaming Engine version 4.5.0

Description Wowza Streaming Engine 4.5.0 contains a condition that allows authenticated users with read-only access to gain administrative privileges. This is achieved by manipulating parameters within POST requests sent to the user edit endpoint. Specifically, attackers can set the accessLevel parameter to 'admin' and the advUser parameters to 'true' and 'on' to obtain administrative access.

Recommendations Apply any available updates or patches to address this issue. As a temporary workaround, restrict access to the user edit endpoint to prevent unauthorized modification of user privileges.

Exploit

Fix

LPE

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2016-20034

Affected Products

Streaming Engine

References · 5

• 🔥 https://exploit-db.com/exploits/40133 · Exploit
• 🔥 http://zeroscience.mk/en/vulnerabilities/ZSL-2016-5340.php · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2016-20034 · Security Note
• https://t.me/CVEtracker/47452 · Telegram Post
• https://vulncheck.com/advisories/wowza-streaming-engine-privilege-escalation-via-user-edit · Note