The vulnerability is an unparameterized SQL injection in the Live_schedule::keyExists() method of the WWBN AVideo platform. During RTMP publish authentication, the stream key supplied by the broadcaster is inserted directly into a SQL statement without escaping or parameterization. This allows an attacker to inject arbitrary SQL, potentially reading, modifying, or deleting data related to live schedules or bypassing authentication. The weakness aligns with CWE‑89.

All installations of WWBN AVideo up to and including version 26.0 are affected. The issue remains in the core Live_schedule module and is triggered when the fallback lookup for stream keys is used during RTMP authentication. No patched release is available at the time of publication, so any site running a vulnerable version and allowing public RTMP publishing is at risk.

The CVSS base score of 9.1 indicates a severe risk. EPSS indicates a low probability of exploitation at the moment (<1 %), and the vulnerability is not listed in the CISA KEV catalog. However, the attack path is remote and requires only a crafted stream key that can be sent over the RTMP publish channel, making it potentially accessible to anyone who can broadcast to the server. The lack of privileged prerequisites means that a normal user could leverage the flaw, emphasizing the urgency of an immediate fix.