CVE-2026-61567: Unauthenticated RCE in AVideo

CVE-2026-61567 affects AVideo, a video-sharing platform, targeting the live-streaming endpoint view/videosListToLive.php. An unauthenticated remote attacker can impersonate a legitimate streamer by exploiting the system's trust in the JSON returned by Login::run, thereby self-granting the isLogged and canStream flags without valid credentials.

According to NVD, this flaw carries CVSS 10.0, the highest rating, published on October 28, 2026. It enables arbitrary operating-system command execution because an attacker-controlled video path is inserted without escaping into the arguments passed to ffprobe and ffmpeg via exec. No GitHub signal of a public exploit is present; social media activity over the last 24 hours flags this CVE as high priority, though these remain unverified signals rather than confirmation of active exploitation.

Potential consequences described in the official documentation include disclosure of database and streamer credentials, compromise of the upstream platform, modification of web-server-owned files, persistence, and denial of the encoding service. Administrators should update immediately to AVideo 8.1.0, review logs for suspicious requests to the affected endpoint, and rotate potentially exposed credentials.