The vulnerability is in the on_publish_done.php endpoint of the Live plugin for WWBN AVideo. The endpoint processes RTMP callback events to mark streams as finished but performs no authentication or authorization. As a result, any user can send a crafted HTTP POST request to terminate any active live broadcast. The weakness corresponds to missing authentication checks (CWE‑306) and leads to denial of service for broadcasters and viewers.

The issue affects WWBN AVideo versions 26.0 and earlier. Administrators running those releases, especially those with the Live plugin enabled, are exposed. The unauthenticated stats.json.php endpoint also allows enumeration of active stream keys, which is required to successfully trigger the termination.

The CVSS score of 7.5 indicates high severity, while the low exploit probability suggests current attacks are unlikely. The vulnerability is not listed in a major exploited vulnerability catalog. The attack requires no privileged access: an external attacker can discover active stream keys through an unsecured API, then post to on_publish_done.php and immediately halt the broadcast. Because the endpoint accepts authenticated or unauthenticated traffic, the attack can be performed remotely from any network that reaches the AVideo server.