Owncast: 3,117 title matches separate the stream key from the admin password

#cybersecurity #zoomeye #exposureinventory

Owncast: 3,117 title matches separate the stream key from the admin password

Owncast combines a public livestream, chat and federation with an administrative API. On 2026-11-04, ZoomEye returned 3,117 matches for title="Owncast" and zero for app="Owncast" with page 1, page size 1 and sub_type=all. The title population is large enough to prioritize by ownership and service state, but it does not prove which hosts are live Owncast servers.

Two credentials with different jobs

Owncast's documentation states that the stream key is used by broadcasting software and is not the admin password. The administrative API uses HTTP Basic authentication or a bearer token depending on the endpoint and current implementation. These credentials should not be interchangeable in operations or in a secret store.

A leaked stream key may let an attacker publish video to a channel. A leaked admin credential may let an attacker change configuration, federation, webhooks or stream state. Record both as separate secrets, rotate them through different procedures and limit the network paths that can use them.

Public playback can be intentional

The public HLS path, player, chat and federation endpoints may be designed for anonymous use. The admin interface is not. Review a public player and a protected admin route separately. Confirm that a login or plugin gate is applied to the admin path before a state-changing API call is authorized.

Owncast's plugin authentication documentation notes that some routes remain public even when a gate is enabled, including the admin pages because they retain their own admin authentication. An operator should understand which gate protects which route rather than assuming that enabling one feature protects every endpoint.

Federation and webhooks expand the blast radius

A configured federation identity can publish go-live announcements. A webhook can send events to another service. An attacker with admin access can change both. Inventory the destination URLs, credentials and event types. Validate that a webhook endpoint uses HTTPS, authenticates the source where possible and does not become an SSRF path into the private network.

The 3,117 title matches should be grouped by certificate, organization and visible stream state. The zero application count means title discovery is not a product count. For owned assets, compare the host with the streaming inventory. For external assets, collect only public metadata.

Review sequence

Identify live, offline and retired Owncast hosts.
Separate stream keys from administrative credentials.
Test the admin route and plugin gate with an ordinary session.
Review federation and webhook destinations.
Confirm public chat and playback behavior is intentional.

ZoomEye supplies the external scope. Owncast's credential and route documentation supplies the control boundary. The practical question is whether a public stream host also grants access to the configuration that controls the stream.