A missing ownership check in the getRestream.json.php endpoint allows authenticated users who have canStream permission to create tokens for any restream, irrespective of ownership. By exchanging these tokens with the getLiveKey.json.php endpoint, attackers can obtain other users’ stream keys. With these keys they can publish to external services such as YouTube, Twitch, or RTMP destinations, enabling unauthorized streaming and potential revenue loss or brand damage.

The vulnerability exists in the AVideo platform maintained by WWBN. Affected versions include any release containing commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier. No specific product version range was supplied, so any instance of AVideo deployed before applying the fix is considered at risk.

The CVSS score of 8.6 indicates high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation data. The attack requires an authenticated session with canStream rights, making it primarily an insider or credential compromise scenario. Once access is achieved, the exploit path is straightforward: mint a token for an arbitrary restream, use it to fetch a stream key, and publish to an external destination.