The vulnerability exists in the live stream control endpoint of the AVideo platform, allowing an attacker to supply a custom streamerURL parameter that redirects token verification to an attacker‑controlled server. The controlled server can always return a success response, effectively bypassing authentication and granting unauthenticated users the ability to drop live publishers, start or stop recordings, and probe the existence of streams. This flaw provides direct, disruptive control over live video streams, potentially impacting availability, integrity, and the integrity of content delivery.

The flaw affects versions of AVideo up to and including 26.0, specifically the plugin located at plugin/Live/standAloneFiles/control.json.php. All installations of the AVideo open‑source video platform deploying this endpoint are susceptible unless upgraded beyond the vulnerable version.

The CVSS base score of 9.4 indicates critical severity, while an EPSS score of less than 1% suggests the exploit probability is currently low. However, the vulnerability is not listed in CISA’s KEV catalog, indicating no publicly known exploit yet. The most likely attack vector is a remote unauthenticated HTTP request to the vulnerable endpoint; an attacker only needs to craft a request containing a forged streamerURL. Once exploited, the attacker gains extensive control over live streams, posing a high risk to operational continuity.