# OpenVibe.Live Security Audit

Current as of **2026-09-17**. The original March 2026 audit is kept at the end as history.

Severity uses a realistic scale: **critical** (anyone can take over accounts, streams or money
today), **high** (a signed-in user can act on someone else's objects or run code), **medium**
(disclosure or abuse that needs specific conditions), **low** (hardening).

## 1. Threat boundaries

| Boundary | Who is on each side | What protects it |
|---|---|---|
| Browser → Live HTTP API | anonymous visitors, signed-in users, API tokens (`hbt_`) | `requireAuth`/`optionalAuth` (server/auth/auth.js), per-object ownership checks in routes, token scopes, rate limits (Express + nginx) |
| Browser → Live WebSockets | same | origin check + IP ban in the upgrade handler (server/index.js), per-server join/auth logic |
| Ingest (RTMP, WHIP) → Live | encoders holding a slot key | slot key lookup, WHIP slot-ownership check, key never returned by public APIs |
| Live → OpenVibe.Media | Live's app key, optionally "acting as" a Live user (`X-OV-User-Id`) | Media's tenant auth; **an app-key call without an acting user has full app authority** (see §4) |
| Live → OpenVibe.Network | JWT verification (RS256 public key), wallet client | signature checks, deadlines |
| Live → user-chosen URLs | song requests (yt-dlp/ffmpeg), kiosk link preview, chat relays | server/net/egress.js: connect-time public-address policy, redirect re-checks, loopback egress proxy for child processes |
| Staff → site | admin, global mod, owner (`is_owner`) | permissions.js role ranks; owner-only for money, secrets, admin grants |

## 2. Fixed in the 2026-09-16/17 pass

Each item below was verified by reading the code (the critical one also against production,
read-only). The Test column names the automated test that covers the fix (test/public-serializers and
test/authorization were also run against the previous code and failed there, case by case);
"manual" means the fix was reviewed and exercised by hand but has no automated test.

| Severity | Finding | Fix | Test |
|---|---|---|---|
| **Critical** | `GET /api/streams/channel/:username` (public) returned every slot's `stream_key` — confirmed on production. Anyone could publish to any streamer's slot. | Explicit public serializers (server/web/serializers.js) on channel, list, recent and detail responses; home ZIP and desk settings removed too. **All slot keys should be rotated after deploying.** | test/public-serializers.test.js |
| High | `POST /api/mod/delete-message` trusted a client `stream_id`: owning any stream allowed deleting any message site-wide. | Checks the message's own stream/channel. | test/authorization.test.js |
| High | Control-profile button edit/delete authorised the profile in the URL, not the button. | SQL scoped by `config_id`; 404 otherwise. | authorization |
| High | Media-request Vibes refund credited the requester even when taking the money back from the streamer failed (repeatable Vibes minting). | Deduction and credit in one transaction; no credit if the deduction fails. | authorization |
| High | A non-owner admin could demote/ban the owner or grant admin. | Owner/admin boundary on role changes and bans. | authorization |
| High | yt-dlp "extra args" (any admin) allowed `--exec`: command execution on the server. | Owner-only, allow-listed flags, disallowed saved values ignored at run time. | authorization |
| High | Pastes proxy sent anonymous requests to Media with app authority: forge pastes/comments as any user, delete any comment, list/read private pastes. | Identity fields stripped from bodies, owner-view switches stripped for anonymous callers, private pastes filtered, comment delete requires sign-in, anonymous write rate limit. | manual (needs Media) |
| High | API token scopes were stored but never enforced (a "read" token could cash out or use admin routes). | Scope enforcement in `requireAuth`/`optionalAuth`; money, staff and credential routes refuse tokens. | authorization |
| High | SSRF: IPv6 spellings of internal IPv4 (`[::ffff:7f00:1]`, NAT64, 6to4) passed the check; DNS rebinding and redirects were not re-checked; yt-dlp/ffmpeg resolved names themselves. | server/net/egress.js: address policy, connect-time lookup, per-hop redirect checks, loopback egress proxy for yt-dlp and ffmpeg (literal-IP bypass found by test and fixed); canonical URLs re-checked. | test/egress.test.js |
| High | Anyone could exhaust the WebRTC SFU: viewer sockets for any stream id created routers/transports. | Viewer sockets only for live streams, 16 per address, viewers never create routers. | manual |
| High | CCBill webhook credited whatever order id the buyer's form URL named (the price digest does not cover `X-order`): pay for a small order, credit a large one. PayPal return read the order before awaiting capture, so a webhook landing in between was credited twice. No webhook checked that the order belonged to that provider. | Provider and paid amount checked on every webhook (CCBill must report a price); orders re-read immediately before crediting; replayed subscription webhooks no longer extend the period. | authorization |
| Medium-High | Chat joined a room by client-supplied `channelUserId`: banned users could post into a channel room and skip its rules; `/ai` controlled other channels' bots. | Room derived from the stream; offline channel chat now applies the channel's latest stream's bans and settings. | security-redaction (ordering) |
| Medium | Relay-user hide/unhide: any user could hide site-wide or delete any channel's hide. | Staff for site-wide; channel moderators for their channel. | authorization |
| Medium | IP-approval queue authorised a channel id as a stream id (IP + geo disclosure). | `canModerateChannel`; review scoped to channel. | authorization |
| Medium | DM: a participant could add a third person to a private 1:1 (who then read the history). | Only group conversations accept new members; blocks checked against every member. | authorization |
| Medium | Hard-coded shared secret on `POST /api/cosmetics/internal-unlock` (in git history). | Configured internal key (timing-safe), or the legacy header from loopback only. | manual |
| Medium | `/banned/continue` trusted a plain display-name cookie (lift any account's ban) and wiped streamer-issued stream bans. | Signed id cookie; site-level bans only. | manual |
| Medium | Control WebSocket forwarded arbitrary command strings and any camera id. | Commands resolved from the stream's enabled buttons; cameras bound to the stream/owner. | manual |
| Medium | Clip upload filed arbitrary video under any stream's channel. | Only for live streams with clipping enabled. | manual |
| Medium | Kiosk link preview followed redirects to internal services and returned their `<title>`. | egress.fetchText. | egress |
| Medium | Chat-relay YouTube host check used `includes` (`youtube.com.evil`), unbounded fetch. | Exact host/subdomain match; guarded, size-capped fetch. | manual |
| Medium | Public VOD/clip lists passed `include_private` to Media under the app key. | Stripped on public lists. | manual |
| Medium | Stream keys in logs (RTMP publish/reject/end, restream command lines incl. SRT passphrases, RS worker ffmpeg line, node-media-server's own connect/publish/play lines). | server/utils/redact.js; the library logs errors only. | manual |
| Medium | OAuth callback skipped the state check when the cookie was missing (login CSRF). | State cookie required. | manual |
| Medium | Media request state (public + broadcast to chat) exposed server file paths and raw yt-dlp errors; `stream-url` returned raw errors to anyone. | Public projection; raw errors only for channel managers. | manual |
| Medium | Real-money Vibes balance and last-seen time on public profiles. | Only for the user themself. | manual |
| Low-Medium | Moderators could change owner policy (grant themselves About editing, disable IP approval). | Owner-only keys ignored for moderators. | manual |
| Low-Medium | Self-donation laundered bought Vibes into cash-out-able Vibes; donation stream id not bound to streamer. | Refused. | manual |
| Low-Medium | Channel-points redemption announced in any stream's chat. | Reward must belong to the stream's channel. | manual |
| Low-Medium | Anyone could set the saved playback position of any media request (unauthenticated). | Channel managers only. | authorization |
| Low-Medium | AI viewer "clone" copied any user's chat history from every channel (and their AI insight) into a bot. | Streamers clone only from what that person said in their own channel; staff unchanged. | authorization |
| Low-Medium | No limit on chat WebSocket connections per address. | 48 per address (admins exempt); clients back off to 30 s on a 4029 close. | test/chat-connection-cap.test.js |
| Medium | Voice: 1:1 call channels were listed publicly and anyone (anonymous included) could walk into them; `call-user` had no rate limit or block check; anyone could answer any invite; a kicked user could rejoin at once; one host could fill the 8-seat Public channel; TURN was emitted without credentials on a box with no secret; static TURN credentials went to every visitor. | Private calls hidden from strangers and invite-only; call-user 6/min + block check; respond requires the invite; 60 s kick cooldown; 3 sockets per address, duplicate accounts replaced; TURN only with credentials; production coturn now runs `use-auth-secret` and every ICE list (voice and SFU, `server/net/turn.js`) carries a credential that expires after an hour — the old static pair no longer authenticates. | test/turn-credentials.test.js + relay probe on the host |
| Medium | Restreams outlived their source: the RobotStreamer passthrough kept its peer open (and restarted forever, without checking the stream was still live) after the broadcaster's socket timed out, OBS stopped, or an admin force-ended the stream — the robot stayed "live" on robotstreamer.com showing black. Force-end only flipped `is_live`. The dashboard's RS Stop button never reached the server. | Every stream-end path (grace timer, RTMP unpublish, WHIP end, stale sweep, admin force-end, own DELETE) stops the RS relay, ffmpeg restreams, chat relays and AI bots; the relay also ends itself on `producer-removed` / the stream row going not-live, backs off and gives up after 12 restarts; `POST /api/robotstreamer/restream/{start,stop}` (owner-only, live stream only); SRT passphrases are stored server-side and never returned (`has_srt_passphrase`), and redacted from ffmpeg command lines in logs. | test/rs-passthrough-lifecycle.test.js, test/restream-manager-lifecycle.test.js |
| Low | Slot `control_config_id` accepted other users' profiles; restream viewer counts writable for any destination. | Ownership checks. | manual |
| Low | ONVIF discovery (LAN scan with default-password probing) available to every user. | Removed with Live's robot controls (2026-10-14, plan T15); robots and cameras are OpenVibe.Bot's. | manual |
| Low | RobotStreamer API calls carrying the user's RS token disabled TLS verification. | Verification on for api.robotstreamer.com (valid certificate). | manual |
| Low | PowerChat test tip broadcast a fake donation to global chat. | Channel room only. | manual |
| Stability | Timer callbacks (RTMP/WHIP heartbeats, renewal sweep) could throw → `uncaughtException` → process exit → every live stream dropped. | Contained. | manual |
| Data integrity | The Vibes ×100 migration re-ran if its settings row was deleted (any admin can delete settings). | Versioned migration ledger (server/db/migrations.js); production shape adopted. | test/migrations.test.js |

Earlier in September (see git history): WHIP slot ownership, stored/reflected XSS in chat, paste
pages and OAuth pages, stream-key leak on `GET /api/streams` and the media channel endpoint, free
Vibes via unverified purchase, chat logs for non-staff, OAuth slot binding for restreams, ingest URL
validation, private VOD cache leak, HTTP-FLV bound to loopback, admin bans never cascading onto staff.

## 3. Content-Security-Policy status

- **Enforced** (helmet, server/index.js): `default-src 'self'` with explicit hosts; scripts still allow
  `'unsafe-inline'` because inline event handlers remain.
- **Report-only** on every HTML document (server/web/assets.js `cspReportOnly`): inline `<script>`
  elements allowed only by SHA-256 hash, `object-src 'none'`, `base-uri 'self'`, restricted
  `form-action` and `frame-ancestors`. Reports go to `POST /api/csp-report` (rate limited, aggregated,
  logged at most once a minute per directive+origin). Verified in Chrome: no report-only violations on
  `/`, `/broadcast`, `/@user`, `/documentation`, `/popout/global`.
- Next: move inline `onclick=` handlers to delegated handlers per route, then drop
  `script-src-attr 'unsafe-inline'` and enforce.

## 4. Remaining risks (not fixed)

| Severity | Risk | Why it is still open / what closes it |
|---|---|---|
| Medium | **Media trusts app-key calls with no acting user.** Live now scrubs anonymous requests, but any future Live route that forgets is app authority again. | Companion change in OpenVibe.Media: an explicit anonymous mode (e.g. `X-OV-Anonymous: 1`) that never trusts `user_id`. |
| Medium | Session token is readable by page scripts (`token`/`ov_token` cookies are not httpOnly; `localStorage.token`), and WebSocket URLs carry it. Any XSS steals the session. | Needs an OpenVibe.Network contract change (httpOnly session + short-lived socket tickets). Mitigation in the repo: deploy/nginx logs requests without query strings (apply to the live nginx), CSP report-only in place. |
| Medium | Inline event handlers keep `'unsafe-inline'` in the enforced CSP. | Progressive migration (see §3). |
| Medium | Per-address limits (broadcast viewers, rate limits) trust `CF-Connecting-IP`; if the origin is reachable without Cloudflare that header is spoofable. | Firewall the origin to Cloudflare ranges (deploy/cloudflare/checklist.md). |
| Low | Chat connect/close/join still scan every client to update counts. | Profile under load before indexing clients by room. |
| Low | RobotStreamer SFU WebSocket connections still skip certificate verification (hosts are assigned by RS at runtime). | Confirm RS SFU certificates and enable verification. |
| Low | Analytics roll-ups (the hourly `aggregate()` in openvibe-shared/analytics/tracker.js, v1.4.0) run synchronously on the main thread. The raw-event prune is no longer a single DELETE: 30 days, in bounded batches (job `analytics-prune`, `retention.pruneRawEvents`). | Change in OpenVibe.Shared, release, bump the pin. |

## 5. Next hardening steps

1. Rotate every `managed_streams.stream_key` after the serializer fix is deployed.
2. OpenVibe.Media anonymous mode (§4).
3. Delegated handlers for inline `onclick` on the lazy routes first (broadcast, dashboard), then CSP enforcement.
4. httpOnly session + WebSocket tickets with OpenVibe.Network.
5. Load-test chat and index clients by room.

---

## History: March 2026 audit (2026-03-09)

That pass hardened the entrypoint (trust proxy, explicit CORS and WebSocket origin checks, auth and
upload rate limits), validated registration/profile input, gated private VOD/clip files, capped
WebSocket payloads, restricted HTTP-FLV origins, normalized monetization amounts, and rendered toasts
as text. Its "remaining risks" — heavy `innerHTML`, inline handlers, a broad alpha feature surface,
tokens in `localStorage`, and a stricter CSP — are tracked above in §3 and §4. The files it referred
to under `server/vod/`, `server/game/game-server.js`, `public/js/admin.js` and
`deploy/systemd/openvibelive.service` have since moved or been removed.