The flaw resides in the Live_schedule::keyExists() function, which concatenates a stream key directly into an SQL query without using parameterized statements. This bypass occurs during RTMP publish authentication, allowing an attacker to supply a specially crafted stream key that injects arbitrary SQL. Successful exploitation could give the attacker read and write access to the database, permitting data exfiltration, tampering with user accounts, or altering system configuration. The vulnerability is classified as CWE-89, indicating a classic SQL injection weakness.

The affected product is WWBN AVideo, an open source video platform. All releases up to and including version 26.0 are vulnerable. No patched version is currently available; vendors have not released an update at the time of this advisory.

The CVSS score is 9.1, representing high severity. EPSS data is unavailable and the issue is not listed in CISA’s Known Exploited Vulnerabilities catalog. It is inferred that the attack vector involves an RTMP publisher sending a malicious stream key during authentication. Because the injection opportunity exists on a public-facing broadcast endpoint, attackers with any RTMP client capability could potentially exploit the flaw, provided they know a valid broadcast URL.