A missing authentication check in the Live/on_publish.php plugin of AVideo allows attackers who can send crafted POST requests with schedule identifiers to mark any scheduled broadcast as failed, effectively canceling the broadcast and compromising the integrity and availability of scheduled live events.

The vulnerability resides in the AVideo platform provided by WWBN. No specific version information is supplied, so any deployment that includes the affected on_publish.php endpoint and exposes it to network traffic is potentially impacted; the issue appears wherever the endpoint is accessible.

The CVSS score of 8.8 indicates a high severity threat, and the EPSS score is not provided. Based on the description, it is inferred that the lack of authentication on the RTMP callback endpoint allows any host with network connectivity to the endpoint to craft and send POST requests to alter broadcast status. The vulnerability is not listed in the CISA KEV catalog. The attack path is simple: forging stream keys that match the -ps-<N> pattern enables unauthenticated actors to cancel scheduled broadcasts from any network where the endpoint is reachable.