AVideo contains an authorization bypass in the handler for live streams where a session cookie named 'key' is read before the expected request parameters. This allows an attacker to inject a value that matches the constant stream key used for live broadcasts. The attacker can then publish a stream to any authenticated user’s channel without needing to supply valid credentials. This results in unauthorized control over live videos, potential denial of service, and exposure of private content.

All installations of WWBN AVideo that include the vulnerable commit c3edcc274c or earlier. No specific version list is provided.

The CVSS score of 8.7 indicates a high severity. The exploit does not require platform privileges and can be performed via a crafted HTTP request that sets the 'key' cookie. Once the attacker sets the cookie to the known constant stream key, the server accepts the request and publishes the stream, bypassing all authentication checks. The EPSS score is not listed, but the lack of an explicit mitigated version and high CVSS suggest a high risk of exploitation. The vulnerability is not listed in the CISA KEV catalog.