CVE-2026-90543: WWBN AVideo Missing Authentication via socketMessageLiveOwner.json.php
WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier, with the Live plugin enabled, contains a missing authentication vulnerability in plugin/Live/socketMessageLiveOwner.json.php. The script reads the key and msg parameters from $REQUEST, resolves the stream owner via LiveTransmition::keyExists, and verifies that the stream owner (not the caller) is an administrator; it performs no User::isLogged() check and enforces no CSRF token. As a result, an unauthenticated remote attacker who knows an administrator's Live stream key can call sendSocketSuccessMessageToUsersid and deliver arbitrary in-app/socket notification messages to that administrator. The issue was unpatched at the time of publication.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker can exploit it if they know the Live stream key of an administrator. No account, prior privileges, or user interaction is required.
Is every AVideo deployment affected?
The affected condition requires the Live plugin to be enabled. The vulnerable endpoint is present at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier.
What can an attacker do with successful exploitation?
An attacker can send arbitrary in-app or socket notification messages to the administrator associated with the known stream key. The provided impact information indicates integrity impact without confidentiality or availability impact.
What can be done if a patch is not available?
No patch was available at publication. Limit exposure of the affected endpoint where possible and protect administrator Live stream keys, since exploitation depends on knowing one of those keys.
How can administrators identify likely exploitation attempts?
Review requests to plugin/Live/socketMessageLiveOwner.json.php, particularly unauthenticated requests supplying key and msg parameters. Unexpected socket or in-app notifications delivered to administrators may also indicate abuse.