CVE-2026-92912 AVideo Cryptographically Weak PRNG via uniqid Stream Key
Attackers can brute-force weak stream keys to hijack live broadcast channels and impersonate owners in AVideo.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-92912?
CVE-2026-92912 is a high-severity vulnerability in WWBN AVideo, published on 17 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 uses cryptographically weak uniqid() values for RTMP publish keys in LiveTransmition, reducing key entropy to approximately one million possibilities per creation second. Attackers who know the channel creation time can brute-force the five-digit microsecond component to forge valid stream keys and broadcast content as the channel owner.
Weakness: CWE-330
Which versions are affected by CVE-2026-92912?
How do I fix CVE-2026-92912?
No fix has been published for CVE-2026-92912 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-92912 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-92912 exists.
Sources
Also known as GHSA-88qh-xch7-cf89, GHSA-h983-2mcw-672j.