WWBN AVideo CVE-2026-81733

Exploitation requires the victim to be a logged-in AVideo user with the streamer role (sufficient session privileges to modify live-channel settings). The attacker must successfully lure this logged-in streamer to visit an attacker-controlled page - no other authentication or server-side access is required by the attacker themselves. The vulnerability is specific to the live-streaming plugin endpoint; AVideo installations that have the Live plugin disabled or that do not host live streams are not exposed to the downstream viewer-redirect impact, though the endpoint may still be accessible. Exploitation is limited by the UI:A (active user interaction) requirement: automated or network-scanning attacks cannot trigger this without a human victim visiting the malicious page. The use of GET-based state changes via $_REQUEST is the enabling condition - if the endpoint were POST-only with strict content-type enforcement, standard <img>-tag and hyperlink-based CSRF would not apply.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N yields a score of 5.1, accurately reflecting the key limiting factor: the attack is passive and requires a logged-in streamer to visit an attacker-controlled page (UI:A). The integrity impact is narrow - only live-channel viewer-redirect settings - with no confidentiality or availability impact. No EPSS data was supplied; no KEV listing exists, and no public proof-of-concept code is referenced. The real-world risk is not infrastructure compromise but downstream phishing exposure for stream viewers, which can be significant for high-traffic streamers with large audiences. The attack complexity is genuinely low once victim interaction is achieved, and the endpoint accepts GET requests, meaning the exploit can be embedded in a simple <img> tag with no JavaScript required. This is a medium-priority finding: serious for affected streamers and their audiences but with no path to code execution or data exfiltration from the server.

An attacker embeds an <img src='https://[target-avideo]/plugin/Live/myLiveControls.save.json.php?customUrl=https://phishing.example&autoRedirect=1'> tag on a page distributed to a streamer via chat or email. When the logged-in streamer's browser loads the page, it silently issues the authenticated GET request, and AVideo's backend updates the live-channel redirect settings with no confirmation prompt. All subsequent viewers of that stream are invisibly redirected to the attacker's phishing site.