CVE-2016-20035: 
Wowza Streaming Engine vulnerability analysis and mitigation

CVE-2016-20035 is a Cross-Site Request Forgery (CSRF) vulnerability in Wowza Streaming Engine 4.5.0 that allows unauthenticated attackers to perform administrative actions by tricking logged-in administrators into visiting a malicious web page. The flaw resides in the user edit endpoint, enabling attackers to craft pages that silently submit POST requests to create new administrator accounts with attacker-controlled credentials. It was originally discovered in 2016 and formally assigned a CVE identifier with NVD publication in March 2026. It carries a CVSS v3.1 base score of 4.3 (Medium) and a CVSS v4.0 base score of 6.9 (Medium) (Feedly, Exploit-DB).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery) and stems from the absence of anti-CSRF token validation on the /enginemanager/server/user/edit.htm endpoint in Wowza Streaming Engine 4.5.0. An attacker crafts a malicious HTML page containing a hidden form that auto-submits a POST request to this endpoint with parameters such as userName, userPassword, and accessLevel=admin. Because the browser automatically includes the authenticated administrator's session cookies with the cross-origin request, the server processes the request as legitimate. A working proof-of-concept exploit demonstrating this technique is publicly available on Exploit-DB (Exploit-DB, Zero Science Lab).

Successful exploitation allows an attacker to create a new administrator account on the Wowza Streaming Engine management interface without any direct authentication. This grants the attacker full administrative control over the streaming infrastructure, including the ability to modify stream configurations, access sensitive media content, disrupt live streaming services, or use the compromised platform as a pivot point for further attacks. The impact is primarily an integrity and authentication bypass, as the attacker gains persistent privileged access without the victim's knowledge (Feedly, Exploit-DB).

A functional proof-of-concept exploit is publicly available on Exploit-DB (EDB-40134), consisting of an HTML form payload that demonstrates the CSRF attack against the user edit endpoint. There is no current evidence of active in-the-wild exploitation or known threat actor attribution. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.014% (0.000140), indicating a very low probability of exploitation in the near term (Exploit-DB, Feedly).

1. Reconnaissance: Identify a target running Wowza Streaming Engine 4.5.0, typically accessible via its web-based management interface on port 8088.
2. Craft malicious page: Create an HTML page containing a hidden auto-submitting form targeting http://<target>:8088/enginemanager/server/user/edit.htm via POST method.
3. Set payload parameters: Include hidden form fields such as userName=attacker, userPassword=P@ssw0rd, accessLevel=admin, and any other required fields as demonstrated in the public PoC.
4. Deliver to administrator: Trick a logged-in Wowza administrator into visiting the malicious page via phishing email, social engineering, or a compromised website.
5. Account created: The administrator's browser automatically submits the form with their active session cookies; the server creates the new admin account without CSRF token validation.
6. Gain access: The attacker logs into the Wowza management interface using the newly created administrator credentials, achieving full administrative control (Exploit-DB, Zero Science Lab).

• Logs: Unexpected POST requests to /enginemanager/server/user/edit.htm in the Wowza Engine Manager access logs, particularly from unusual referrer origins or with no referrer header.
• Logs: Creation of new administrator accounts in Wowza audit/event logs at unexpected times or without a corresponding administrator session from a known IP.
• Network: HTTP POST traffic to port 8088 on the Wowza server originating from unexpected internal or external sources.
• Application: Presence of unfamiliar administrator usernames in the Wowza Streaming Engine user management interface that were not created by known administrators.

No official vendor patch specific to this CVE has been publicly documented; administrators should verify whether their current Wowza Streaming Engine version has addressed CSRF protections. As immediate mitigations, implement anti-CSRF tokens on all state-changing requests, apply SameSite=Strict or SameSite=Lax cookie attributes to session cookies, and require re-authentication before creating new administrator accounts. Administrators should restrict access to the Wowza Engine Manager interface (port 8088) to trusted IP addresses via firewall rules, and train administrators to avoid clicking untrusted links while authenticated to the management console (Feedly, Zero Science Lab).

The vulnerability was originally disclosed by Zero Science Lab in 2016 and received renewed attention when formally assigned a CVE and published to NVD in March 2026. Coverage has appeared on vulnerability tracking platforms including VulnDB, CVEFeed, and CIRCL, as well as a technical write-up on Infinit Security's blog. No significant vendor statement from Wowza Media Systems or notable researcher commentary beyond the original Zero Science Lab advisory has been identified (Zero Science Lab, Infinit Security).