AVideo-Encoder versions prior to 8.1.0 expose a live streaming endpoint that freely accepts an attacker-specified streamer name in the webSiteRootURL field. The request is processed without verifying the client’s credentials, the returned JSON is treated as authenticated session data, and user-provided video paths are inserted directly into shell commands that invoke ffprobe and ffmpeg. This flaw permits an unauthenticated remote attacker to execute arbitrary operating‑system commands under the web-server user, potentially leaking database credentials, compromising upstream services, altering server files, establishing persistence, and disabling the encoder. The weakness corresponds to CWE‑78: OS Command Injection.

All releases of WWBN’s AVideo-Encoder before version 8.1.0 are vulnerable. The problem is resolved in the 8.1.0 release and later.

The CVSS score of 10 indicates critical severity. Exploitation requires the attacker to host a controllable HTTP service reachable by the encoder, supply a valid APISecret and playlists_id, then embed malicious shell delimiters in the video list’s path field. Because the endpoint never checks a stored API secret or validates the streamer allowlist, the attack can be carried out against any user with network access to the encoder. The vulnerability is not listed in CISA’s KEV catalog and no EPSS score is currently available, but its inherent remote execution capability means it poses a substantial risk when present.