Technical impact
The Live plugin’s socketMessageLiveOwner.json.php endpoint lacks authentication and CSRF checks. It accepts a stream key and message, verifies that the stream key belongs to an administrator, but does not verify the requester's identity. An unauthenticated attacker that knows an administrator’s live stream key or malicious content to be delivered and facilitating social‑engineering or communication disruption. The weakness is a pure authentication bypass (CWE‑306).
Affected Systems
Any installation of WWBN AVideo running a release older than the commit c3edcc274c389816d434acadac07ee78eaf330c1 in plugin/Live/socketMessageLiveOwner.json.php and persists until an update removes or protects it.
Risk and Exploitability
The CVSS score of 6.9 indicates medium severity, and the EPSS score is <1%, implying a very low but non‑zero exploitation probability; the vulnerability is not listed in CISA KEV. Exploitation requires only remote HTTP access to the exposed endpoint and knowledge of an administrator’s live stream key. No authentication or CSRF token is required, making the attack straightforward once the key is known. The risk is primarily in the ability to inject arbitrary notifications to administrators, potentially undermining trust or enabling phishing, but it does not provide direct system compromise or privilege escalation.
