CVE-2026-92912

MediumCVSS 6.5/10Last modified Sep 22, 2026

Description

AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 uses cryptographically weak uniqid() values for RTMP publish keys in LiveTransmition, reducing key entropy to approximately one million possibilities per creation second. Attackers who know the channel creation time can brute-force the five-digit microsecond component to forge valid stream keys and broadcast content as the channel owner.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N

Weakness enumeration

CWE-330

Affected software

No affected versions have been published.

Timeline

Published: Sep 17, 2026
Last modified: Sep 22, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-929137.4AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 uses a cryptographically weak pseudo-random number generator when creating ac CVE-2026-929148.1AVideo LoginControl contains an authentication bypass vulnerability in the PGP second factor verification that compares challenge responses CVE-2026-929157.3WWBN AVideo through commit e01e41ecc (no patched version available) contains a broken access control flaw in objects/userVerifyEmail.php. Th CVE-2026-929167.5Grav is a flat-file CMS. In Grav 1.7.0 through 1.7.53.2 and 2.0.0 through 2.0.21, when the debugger is enabled (system.debugger.enabled: tru CVE-2026-929177.5Grav is a flat-file CMS. In versions 2.0.0-rc.1 through 2.0.21, the Twig content sandbox fails to restrict the dump and serialize filters (p CVE-2026-929188.8admin3 through 3.0.0 persists user session tokens in the audit log event body when publishing UserLoggedIn domain events. Attackers with log CVE-2026-929198.1admin3 through 3.0.0 fails to sanitize client-supplied filenames in the upload handler, allowing authenticated users to write files outside CVE-2026-92928.4A Stored Cross-Site Scripting security issue exists within FactoryTalk® DataMosaix™ Private Cloud. The vulnerability stems from improper neu CVE-2026-929205.4admin3 through 3.0.0 fails to invalidate existing sessions when disabling a user account, allowing attackers to retain authenticated access CVE-2026-929214.9admin3 through 3.0.0 stores account passwords using single-round MD5 with only the username as salt and no key derivation function. Attacker CVE-2026-929228.1Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject CVE-2026-929236.3The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise and escape a parameter before using it in a SQL statem