Avideo CVE-2026-34731

WWBN AVideo versions 26.0 and prior with Live plugin enabled. Attacker must enumerate active stream keys from unauthenticated stats.json.php endpoint, then send POST requests to on_publish_done.php. No authentication required. Remote unauthenticated exploitation.

Real-world risk is significant for organizations running WWBN AVideo for live streaming services. The CVSS 7.5 High severity reflects the severe availability impact (A:H) combined with trivial exploitation requirements: network-accessible (AV:N), low complexity (AC:L), no privileges required (PR:N), and no user interaction needed (UI:N). While the vulnerability is limited to availability impact (C:N/I:N), the ability to terminate any live stream represents a critical business disruption for platforms relying on this functionality. No EPSS exploitation probability data is available, and no public exploit code exists at time of analysis. The vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation in the wild. However, exploitation is trivially automatable given the straightforward HTTP POST attack vector and public endpoint exposure. The primary exploitation barrier is that attackers must first enumerate valid stream keys from the unauthenticated stats endpoint, though this is a minor obstacle. The absence of vendor patches at publication time significantly elevates operational risk, as affected organizations have no official remediation path beyond custom code modifications or service discontinuation.

An attacker first accesses the unauthenticated stats.json.php endpoint on a target AVideo platform to enumerate all currently active live streams and their associated stream keys. Using this information, the attacker crafts HTTP POST requests to the on_publish_done.php endpoint, including the enumerated stream keys as parameters to mimic legitimate RTMP server callbacks. The endpoint processes these malicious requests without authentication, immediately marking the targeted streams as finished in the database and terminating the live broadcasts. This attack can be automated to continuously target all active streams, effectively disabling all live streaming capability on the platform and causing significant service disruption for content creators and viewers. No public exploit code exists, but exploitation requires only basic HTTP request tools and knowledge of the vulnerable endpoint structure.