What is GHSA-pr7w-97g9-f8rw?

GHSA-pr7w-97g9-f8rw is a security advisory published by GitHub Security Advisories with High severity. AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to verify ownership in...

Which CVE IDs does GHSA-pr7w-97g9-f8rw cover?

GHSA-pr7w-97g9-f8rw covers the following CVE IDs: CVE-2026-89252. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-pr7w-97g9-f8rw?

GHSA-pr7w-97g9-f8rw has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

GHSA-pr7w-97g9-f8rwHighCVSS 6.5

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to verify ownership in...

Vendor

GitHub Security Advisories

Published

September 11, 2026

Last Modified

September 11, 2026

🔗 CVE IDs covered (1)

CVE-2026-89252 →

📋 Description

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to verify ownership in addLiveLink.php when updating LiveLinks, allowing authenticated users to modify other users' links. A canStream user can overwrite another user's LiveLink HLS source and metadata by supplying an existing linkId, redirecting viewers to attacker-controlled media.

🔗 References (4)

https://github.com/WWBN/AVideo/security/advisories/GHSA-m2c6-f5ww-j26v
https://nvd.nist.gov/vuln/detail/CVE-2026-89252
https://www.vulncheck.com/advisories/avideo-missing-authorization-in-addlivelink-php-livelink-update
https://github.com/advisories/GHSA-pr7w-97g9-f8rw