WWBN AVideo CVE-2026-89252

Exploitation requires an authenticated account with the canStream role on the target AVideo instance; unauthenticated users and accounts lacking canStream privilege cannot exploit this flaw. The attacker must additionally know or enumerate a valid linkId belonging to a different user who has an existing LiveLink configured - the endpoint updates existing records and cannot create a new LiveLink under a victim's account via this path. No special server configuration beyond the default multi-user AVideo deployment is required. The principal limiting factors are: (1) authentication with canStream privilege, and (2) knowledge of a victim's linkId value.

The CVSS 4.0 score of 7.1 with VI:H and all confidentiality/availability metrics at None accurately characterizes this as a pure integrity flaw - stream hijacking with no data exfiltration or service disruption. The PR:L requirement is the primary gate: exploitation demands a valid canStream account, limiting the attacker population to registered platform users. With no EPSS data supplied and no CISA KEV listing, real-world exploitation probability is moderate but not negligible - even a mid-sized municipal IT team in ustka running a shared AVideo instance with multiple canStream users should treat this as a meaningful risk, particularly where stream credibility matters (news, education, or monetized content). The absence of a public POC lowers immediate urgency, but the trivial exploit mechanics (a single crafted POST with a guessed or enumerated linkId) mean a capable insider or compromised low-privilege account could cause significant reputational damage.

An authenticated canStream user enumerates valid linkId values belonging to other platform users - either through sequential guessing or by observing IDs exposed in normal platform API responses - then submits a crafted POST request to addLiveLink.php specifying the victim's linkId alongside an attacker-controlled HLS URL. The server processes the update without checking ownership, silently redirecting the victim's live stream viewers to attacker-controlled media content. No public exploit code has been identified at time of analysis, but the attack requires only standard HTTP tooling.