PT-2026-29361 · Avideo · Live Plugin+1

Adrgs · Published 2026-03-31 · Updated 2026-04-01 · CVE-2026-34731

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions AVideo versions 26.0 and prior

Description The AVideo platform, specifically the Live plugin, has an issue where the on publish done.php endpoint does not perform authentication or authorization checks. Unauthenticated users can terminate active live streams by sending crafted POST requests to this endpoint. Attackers can obtain active stream keys from the stats.json.php endpoint and use them to disrupt live broadcasts, leading to a denial-of-service against the live streaming functionality.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-34731

GHSA-4JCG-JXPF-5VQ3

Affected Products

Avideo

Live Plugin

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34731.json · Exploit
• 🔥 https://github.com/WWBN/AVideo/security/advisories/GHSA-4jcg-jxpf-5vq3 · Exploit
• https://osv.dev/vulnerability/CVE-2026-34731 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4jcg-jxpf-5vq3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34731 · Security Note
• https://github.com/WWBN/AVideo · Note
• https://github.com/WWBN/AVideo/commit/e0b9e71f6f3b34f12ad78c1a69d4e1f584b49673 · Note
• https://twitter.com/CVEnew/status/2039372121298620476 · Twitter Post