Owncast: 3,117 title matches separate the stream key from the admin password
Owncast: 3,117 title matches separate the stream key from the admin password
Owncast combines a public livestream, chat and federation with an administrative API. On 2026-11-04, ZoomEye returned 3,117 matches for title="Owncast" and zero for app="Owncast" with page 1, page size 1 and sub_type=all. The title population is large enough to prioritize by ownership and service state, but it does not prove which hosts are live Owncast servers.
Two credentials with different jobs
Owncast's documentation states that the stream key is used by broadcasting software and is not the admin password. The administrative API uses HTTP Basic authentication or a bearer token depending on the endpoint and current implementation. These credentials should not be interchangeable in operations or in a secret store.
A leaked stream key may let an attacker publish video to a channel. A leaked admin credential may let an attacker change configuration, federation, webhooks or stream state. Record both as separate secrets, rotate them through different procedures and limit the network paths that can use them.
Public playback can be intentional
The public HLS path, player, chat and federation endpoints may be designed for anonymous use. The admin interface is not. Review a public player and a protected admin route separately. Confirm that a login or plugin gate is applied to the admin path before a state-changing API call is authorized.
Owncast's plugin authentication documentation notes that some routes remain public even when a gate is enabled, including the admin pages because they retain their own admin authentication. An operator should understand which gate protects which route rather than assuming that enabling one feature protects every endpoint.
Federation and webhooks expand the blast radius
A configured federation identity can publish go-live announcements. A webhook can send events to another service. An attacker with admin access can change both. Inventory the destination URLs, credentials and event types. Validate that a webhook endpoint uses HTTPS, authenticates the source where possible and does not become an SSRF path into the private network.
The 3,117 title matches should be grouped by certificate, organization and visible stream state. The zero application count means title discovery is not a product count. For owned assets, compare the host with the streaming inventory. For external assets, collect only public metadata.
Review sequence
- Identify live, offline and retired Owncast hosts.
- Separate stream keys from administrative credentials.
- Test the admin route and plugin gate with an ordinary session.
- Review federation and webhook destinations.
- Confirm public chat and playback behavior is intentional.
ZoomEye supplies the external scope. Owncast's credential and route documentation supplies the control boundary. The practical question is whether a public stream host also grants access to the configuration that controls the stream.
References
[1] Owncast web APIs
[2] Owncast plugin authentication and public routes
[3] Owncast federation documentation
Owncast: Take control over your content and stream it yourself (12k stars)
What it does
All text below is quoted directly from the project README.
>Owncast is an open source, self-hosted, decentralized, single user live video streaming and chat server for running your own live streams similar in style to the large mainstream options. It offers complete ownership over your content, interface, moderation and audience.
Use with your existing broadcasting software:
- In general, Owncast is compatible with any software that uses RTMP to broadcast to a remote server.
- RTMP is what all the major live streaming services use, so if you're currently using one of those it's likely that you can point your existing software at your Owncast instance instead.
- OBS, Streamlabs, Restream and many others have been used with Owncast.
- The Owncast backend is written in Go.
- The frontend is written in React.
- The frontend is the web interface that includes the player, chat, embed components, and other UI.
>The goal is to have a single service that you can run and it works out of the box. Visit the Quickstart to get up and running.
Repository
owncast/owncast
Repository stats
|Metric|Value|
|:-|:-|
|Stars|11,612|
|Forks|1,186|
|Last release|v0.3.0 (2026-09-03)|
|Languages|Go 46.2%, TypeScript 25%, CSS 16%|
|Contributors|191|
|AI contributor accounts (Claude / Codex / Cursor / Copilot)|Copilot: 28, claude: 31|
|AI co-authored commits|Claude: 15, Copilot: 22|
Main contributor
|Field|Value|
|:-|:-|
|Name|Gabe Kangas|
|GitHub|@gabek|
|Commits to this repo|3,981 (top contributor)|
|Company / Location|San Francisco, CA|
|Website|gabekangas.com|
|Followers|297|
|Public repos|43|
|On GitHub since|2010-09-24|
8 points
owncast ⭐ 12k
Owncast is an open-source, self-hosted server for live video streaming and chat, for developers who want to run their own streaming platform.
🔗 owncast/owncast
#opensource t.co
3 views
Mentions
Owncast: 3,117 title matches separate the stream key from the admin password Owncast: 3,117 title matches separate the stream key from the admin password Owncast combines a public livestream, chat and federation with an administrative API. On 2026-11-04, ZoomEye returned 3,117 matches for title="Owncast" and zero for app="Owncast" with page 1, page size 1 and sub_type=all. The title population is large enough to prioritize by ownership and service state, but it does not prove which hosts are live Owncast servers. Two credentials with different jobs Owncast's documentation states that the stream key is used by broadcasting software and is not the admin password. The administrative API uses HTTP Basic authentication or a bearer token depending on the endpoint and current implementation. These credentials should not be interchangeable in operations or in a secret store. A leaked stream key may let an attacker publish video to a channel. A leaked admin credential may let an attacker change configuration, federation, webhooks or stream state. Record both as separate secrets, rotate them through different procedures and limit the network paths that can use them. Public playback can be intentional The public HLS path, player, chat and federation endpoints may be designed for anonymous use. The admin interface is not. Review a public player and a protected admin route separately. Confirm that a login or plugin gate is applied to the admin path before a state-changing API call is authorized. Owncast's plugin authentication documentation notes that some routes remain public even when a gate is enabled, including the admin pages because they retain their own admin authentication. An operator should understand which gate protects which route rather than assuming that enabling one feature protects every endpoint. Federation and webhooks expand the blast radius A configured federation identity can publish go-live announcements. A webhook can send events to another service. An attacker with admin access can change both. Inventory the destination URLs, credentials and event types. Validate that a webhook endpoint uses HTTPS, authenticates the source where possible and does not become an SSRF path into the private network. The 3,117 title matches should be grouped by certificate, organization and visible stream state. The zero application count means title discovery is not a product count. For owned assets, compare the host with the streaming inventory. For external assets, collect only public metadata. Review sequence - Identify live, offline and retired Owncast hosts. - Separate stream keys from administrative credentials. - Test the admin route and plugin gate with an ordinary session. - Review federation and webhook destinations. - Confirm public chat and playback behavior is intentional. ZoomEye supplies the external scope. Owncast's credential and route documentation supplies the control boundary. The practical question is whether a public stream host also grants access to the configuration that controls the stream. References [1] Owncast web APIs [2] Owncast plugin authentication and public routes [3] Owncast federation documentation
Owncast: Take control over your content and stream it yourself (12k stars) What it does All text below is quoted directly from the project README. >Owncast is an open source, self-hosted, decentralized, single user live video streaming and chat server for running your own live streams similar in style to the large mainstream options. It offers complete ownership over your content, interface, moderation and audience. Use with your existing broadcasting software: - In general, Owncast is compatible with any software that uses RTMP to broadcast to a remote server. - RTMP is what all the major live streaming services use, so if you're currently using one of those it's likely that you can point your existing software at your Owncast instance instead. - OBS, Streamlabs, Restream and many others have been used with Owncast. - The Owncast backend is written in Go. - The frontend is written in React. - The frontend is the web interface that includes the player, chat, embed components, and other UI. >The goal is to have a single service that you can run and it works out of the box. Visit the Quickstart to get up and running. Repository owncast/owncast Repository stats |Metric|Value| |:-|:-| |Stars|11,612| |Forks|1,186| |Last release|v0.3.0 (2026-09-03)| |Languages|Go 46.2%, TypeScript 25%, CSS 16%| |Contributors|191| |AI contributor accounts (Claude / Codex / Cursor / Copilot)|Copilot: 28, claude: 31| |AI co-authored commits|Claude: 15, Copilot: 22| Main contributor |Field|Value| |:-|:-| |Name|Gabe Kangas| |GitHub|@gabek| |Commits to this repo|3,981 (top contributor)| |Company / Location|San Francisco, CA| |Website|gabekangas.com| |Followers|297| |Public repos|43| |On GitHub since|2010-09-24|
owncast ⭐ 12k Owncast is an open-source, self-hosted server for live video streaming and chat, for developers who want to run their own streaming platform. 🔗 owncast/owncast #opensource t.co