The Live plugin’s socketMessageLiveOwner.json.php endpoint lacks authentication and CSRF checks. It accepts a stream key and message, verifies that the stream key belongs to an administrator, but does not verify the requester's identity. An unauthenticated attacker that knows an administrator’s live stream key can therefore send arbitrary in‑app or socket notification messages directly to that administrator, allowing misleading or malicious content to be delivered and facilitating social‑engineering or communication disruption. The weakness is a pure authentication bypass (CWE‑306).

Any installation of WWBN AVideo running a release older than the commit c3edcc274c389816d434acadac07ee78eaf330c1 in plugin/Live/socketMessageLiveOwner.json.php and persists until an update removes or protects it.

The CVSS score of 6.9 indicates medium severity, and the EPSS score is unavailable; the vulnerability is not listed in CISA KEV. Exploitation requires only remote HTTP access to the exposed endpoint and knowledge of an administrator’s live stream key. No authentication or CSRF token is required, making the attack straightforward once the key is known. The risk is primarily in the ability to inject arbitrary notifications to administrators, potentially undermining trust or enabling phishing, but it does not provide direct system compromise or privilege escalation.