The vulnerability is a cross‑site request forgery in deleteHistory.json.php and finishAll.json.php that accepts GET requests without a CSRF token. An unauthenticated attacker can cause an administrator’s browser to send these requests, resulting in the deletion of all live transmission history or marking streams as finished. This compromises audit data and can disrupt service operation, representing unauthorized data modification and a denial‑of‑service vector for broadcasting services.

The CNA lists WWBN:AVideo as the affected vendor and product. No specific version numbers are provided, so any current AVideo installation that contains the unpatched deleteHistory.json.php or finishAll.json.php files is at risk. The commit reference c3edcc274c389 indicates the code that introduced the flaw, implying the vulnerability exists in all releases prior to that commit.

The CVSS score of 7.1 places the issue in the high severity range. EPSS data is unavailable and the vulnerability is not listed in CISA's KEV catalog, suggesting a moderate current exploitation probability. The exploit requires only a malicious web page that an administrator visits; once a privileged session is active, the attacker can immediately trigger the state changes. Because CSRF bypasses authentication, the risk to systems that allow administrators to access the web interface is significant.