CVE-2021-31539: 
Wowza Streaming Engine vulnerability analysis and mitigation

Wowza Streaming Engine through 4.8.5 (in a default installation) has cleartext passwords stored in the conf/admin.password file. A regular local user is able to read usernames and passwords (CISA, NIST).

The vulnerability exists due to improper storage of authentication credentials in plaintext format within the conf/admin.password file. In the default installation configuration, the file permissions allow regular local users to read the contents of configuration files in the conf/ directory, including the admin.password file that contains usernames and passwords (CISA).

The vulnerability allows local users to obtain administrative credentials stored in cleartext, potentially leading to unauthorized access to administrative functions and elevated privileges within the Wowza Streaming Engine system (CISA).

This vulnerability was fixed in Wowza Streaming Engine version 4.8.8.01, which introduced security improvements related to password storage. The update provides options to encode passwords using Bcrypt or digest hash functions and includes a command-line tool for user management. The Linux installer also updates permissions on several directories (Wowza Docs).