The vulnerability is caused by AVideo's use of PHP's uniqid() function to generate RTMP publish keys. This creates a key space of only about one million possibilities per second, far too small for secure unique identifiers. If an attacker can determine the channel creation time, the five‑digit microsecond component can be brute‑forced rapidly, allowing the attacker to forge a valid stream key and publish content as the legitimate channel owner. With control of the stream, an attacker could inject misinformation, malicious content, or disrupt legitimate broadcasts, undermining the platform’s integrity and trustworthiness.

The affected product is AVideo from WWBN, as identified in the public advisory. The flaw appears in code at commit c3edcc274c389816d434acadac07ee78eaf330c1; no specific version numbers are provided, so any install of AVideo prior to the fix is potentially vulnerable.

This issue carries a CVSS score of 8.3, indicating high severity. The exploitation probability is not quantified by EPSS, but the limited keyspace means that an attacker who can approximate the stream creation time can brute‑force a valid key in a short period. The vulnerability is not listed in the CISA KEV catalog, yet it can enable unauthenticated broadcast impersonation, representing a significant risk to content integrity and platform reputation. The most likely attack vector is a network‑based brute‑force on the stream key derived from the known creation time.