The vulnerability lies in the AVideo Live_restreams plugin, which accepts a token parameter that disables both the restream permission check and the ownership validation. The token is simply an AES-256-CBC encrypted integer ID without an authentication tag or user association. Because the IV is deterministic and no MAC is applied, anyone can forge tokens, resulting in the endpoint revealing any user's stream_key and stream_url for external platforms such as YouTube, Facebook, or Twitch. The flaw allows an attacker to obtain sensitive credentials that enable unauthorized broadcast to third‑party services, thereby exposing confidentiality and potentially allowing further malicious activity such as impersonation or data exfiltration through the stream channel.

This flaw affects the WWBN AVideo product, specifically versions released before commit e01e41ecc. The vulnerability is present in all releases up to and including that commit, regardless of the operating system or deployment environment.

The CVSS score of 9.2 indicates critical severity, and the lack of authentication or rate limiting on the endpoint makes exploitation trivial for an unauthenticated attacker. Although EPSS data is not available, the deterministic nature of the encryption and public oracle in the view/url2Embed.json.php endpoint make token forging straightforward. The issue is not listed in the CISA KEV catalog, but the high CVSS and obvious attack path warrant immediate attention.