The vulnerability is an IDOR in the Live uploadPoster.php script. Any authenticated user can submit a request with an arbitrary live_schedule_id, overriding the poster image for the target scheduled live stream. After the image is changed, the endpoint broadcasts a socketLiveOFFCallback notification that includes the victim’s broadcast key and user ID to every connected WebSocket client. This allows an attacker to tamper with other users’ live streams and potentially expose sensitive identifiers. The weakness is classified as CWE‑862.

This flaw exists in WWBN’s AVideo platform through version 26.0. It affects all deployments of the open‑source media platform that run the legacy uploadPoster.php handler under the Live module.

The CVSS score of 5.4 indicates moderate severity, and the EPSS score of less than 1 % suggests low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires only an authenticated session; any user with valid credentials can issue a simple HTTP/HTTPS POST to the endpoint with a chosen live_schedule_id. The attacker can overwrite the poster and trigger false socket notifications, but cannot gain remote code execution or full system compromise. The impact is limited to data integrity and potential social‑engineering of stream recipients.