The error occurs when an attacker supplies a crafted stream name during the RTMP on_publish callback. The application directly interpolates the stream key into two SQL statements within LiveTransmitionHistory::getLatest() and LiveTransmition::keyExists() without parameter binding or escaping. This results in a time‑based blind SQL injection that can be leveraged by an unauthenticated user to read every row from the database, including password hashes and email addresses. Because the data is publicly available to anyone who can initiate an RTMP publish request, the confidentiality of user accounts is fully compromised.

The vulnerability affects the WWBN AVideo platform, versions up to and including 26.0. Any deployment of these versions that exposes the RTMP on_publish endpoint without authentication is at risk. Upgrading to a version that includes the patch in commit af59eade82de645b20183cc3d74467a7eac76549 removes the flaw.

The CVSS score of 7.5 classifies the issue as high severity. EPSS indicates the probability of exploitation is less than 1%, and the vulnerability has not been reported in the CISA KEV catalog. The attack vector is unauthenticated and remote, requiring only the ability to send an RTMP publish request. Because it is a blind injection, an attacker can perform a time‑based extraction without immediate feedback, making automated exploitation more tedious but still feasible for a determined adversary. Users with remote RTMP access are therefore at a significant risk until the patch is applied.