---
id: CVE-2026-61569
title: 'AVideo-Encoder: pre-authentication streamer-login SQL injection'
summary: >-
  AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated
  streamer login at `objects/login.json.php` passes the `user` parameter to
  `Streamer::get` in `objects/Streamer.php`, where it is interpolated into a
  single-quoted Ma…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-89
vendor: WWBN
product: AVideo-Encoder
affected:
  - AVideo-Encoder < 8.1.0
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-29T15:10:55.439289Z'
exploitAvailable: true
published: '2026-10-28'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T15:11:35.842Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-61569'
references:
  - url: >-
      https://github.com/WWBN/AVideo-Encoder/security/advisories/GHSA-2rrq-xf8q-3qpf
    label: >-
      https://github.com/WWBN/AVideo-Encoder/security/advisories/GHSA-2rrq-xf8q-3qpf
  - url: >-
      https://github.com/WWBN/AVideo-Encoder/commit/8a6e2b8aedb87702656636d3fc8d9e26e559a762
    label: >-
      https://github.com/WWBN/AVideo-Encoder/commit/8a6e2b8aedb87702656636d3fc8d9e26e559a762
  - url: 'https://github.com/WWBN/AVideo-Encoder/releases/tag/v8.1.0'
    label: 'https://github.com/WWBN/AVideo-Encoder/releases/tag/v8.1.0'
tags:
  - cve.org
  - exploit-available
epss: 0.00282
epssPercentile: 0.20894
ingestedAt: '2026-11-01T20:00:16.950Z'
---

## Overview

AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated streamer login at `objects/login.json.php` passes the `user` parameter to `Streamer::get` in `objects/Streamer.php`, where it is interpolated into a single-quoted MariaDB SELECT without parameterization or escaping. Although `objects/security.php` strips literal single quotes, `html_entity_decode` in `objects/Login.php` restores entity-encoded quotes before the query. The supplied `siteURL` must pass the streamer allowlist, which allows all sites when empty by default, and an attacker-hosted login response must set `canUpload` or `isAdmin` to reach `Streamer::createIfNotExists`. That function calls `Streamer::get` before its additional allowlist check. UNION results are exposed through `streamers_id`, while failures return the rendered query and MariaDB error. An attacker can read arbitrary encoder database data, including stored upstream streamer credentials, allowlist configuration, and queue records, without encoder credentials. Stacked statements are not permitted by the mysqli driver and the tested database account lacks global FILE privilege, so the demonstrated vector is bounded to reads rather than server-side file writes. Stolen streamer credentials can provide continued upstream access until rotated. This issue is fixed in version 8.1.0.

## Affected

- `AVideo-Encoder < 8.1.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.