From f1e0a025c68fe7c5e5efc76f765164408aff6e13 Mon Sep 17 00:00:00 2001
From: Josh Hawkins <32435876+hawkeye217@users.noreply.github.com>
Date: Sat, 7 Nov 2026 12:50:09 -0600
Subject: [PATCH] don't trust live stream names as existing go2rtc streams

---
 frigate/api/auth.py                           |  8 ++++++-
 .../http_api/test_http_auth_internal_port.py  | 21 +++++++++++++++++++
 frigate/test/test_go2rtc_stream_auth.py       |  7 ++++++-
 3 files changed, 34 insertions(+), 2 deletions(-)

diff --git a/frigate/api/auth.py b/frigate/api/auth.py
index 2fb14badcc..a925e008cf 100644
--- a/frigate/api/auth.py
+++ b/frigate/api/auth.py
@@ -39,6 +39,7 @@ from frigate.config import AuthConfig, ProxyConfig
 from frigate.const import CONFIG_DIR, JWT_SECRET_ENV_VAR, PASSWORD_HASH_ALGORITHM
 from frigate.models import User
 from frigate.notices import raise_notice
+from frigate.util.live_streams import is_transcode_stream_name
 from frigate.util.origin import origin_allowed
 
 logger = logging.getLogger(__name__)
@@ -1282,7 +1283,12 @@ def _is_existing_go2rtc_stream(request: Request, stream_name: str) -> bool:
     """
     frigate_config = request.app.frigate_config
 
-    if _get_stream_owner_cameras(request, stream_name):
+    # live.streams values are free-form config, so only names Frigate controls
+    # skip the lookup
+    if any(
+        stream_name == camera or is_transcode_stream_name(camera, stream_name)
+        for camera in frigate_config.cameras
+    ):
         return True
 
     config_streams = getattr(frigate_config.go2rtc, "streams", None) or {}
diff --git a/frigate/test/http_api/test_http_auth_internal_port.py b/frigate/test/http_api/test_http_auth_internal_port.py
index 1f2d820635..a3018d0b63 100644
--- a/frigate/test/http_api/test_http_auth_internal_port.py
+++ b/frigate/test/http_api/test_http_auth_internal_port.py
@@ -280,6 +280,27 @@ class TestAuthInternalPort(BaseTestHttp):
                 )
                 self.assertEqual(resp.status_code, 202, url)
 
+    @patch(
+        "frigate.api.auth.requests.get",
+        side_effect=requests.ConnectionError("go2rtc unavailable"),
+    )
+    def test_live_stream_value_is_not_trusted_as_a_go2rtc_stream(self, _mock_get):
+        src = "ffmpeg:x#raw=-f"
+        self.minimal_config["cameras"]["front_door"]["live"] = {
+            "streams": {"Main": src}
+        }
+        app = self._create_app()
+
+        with AuthTestClient(app) as client:
+            resp = client.get(
+                "/auth",
+                headers={
+                    "x-server-port": "5000",
+                    "x-original-url": "/live/mse/api/ws?src=ffmpeg:x%23raw=-f",
+                },
+            )
+            self.assertEqual(resp.status_code, 403)
+
 
 if __name__ == "__main__":
     unittest.main(verbosity=2)
diff --git a/frigate/test/test_go2rtc_stream_auth.py b/frigate/test/test_go2rtc_stream_auth.py
index ddbf579630..41caf489d0 100644
--- a/frigate/test/test_go2rtc_stream_auth.py
+++ b/frigate/test/test_go2rtc_stream_auth.py
@@ -23,7 +23,12 @@ _CONFIG = {
             "dual_user": ["front_door", "back_door"],
         }
     },
-    "go2rtc": {"streams": {"doorbell_audio": ["rtsp://10.0.0.4:554/audio"]}},
+    "go2rtc": {
+        "streams": {
+            "doorbell_audio": ["rtsp://10.0.0.4:554/audio"],
+            "front_door_sub": ["rtsp://10.0.0.1:554/sub"],
+        }
+    },
     "cameras": {
         "front_door": {
             "ffmpeg": {