EUVD-2026-14502
GHSA-9hv9-gvwm-95f2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted HTTP request to control.json.php
-
DeliverySupply malicious streamerURL parameter
-
ExploitRedirect token verification to attacker server
-
ExecutionReturn false authentication response
-
ImpactBypass authentication and control live stream
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Remote unauthenticated attacker exploits the standalone live stream control endpoint at plugin/Live/standAloneFiles/control.json.php in WWBN AVideo versions up to 26.0 by supplying a malicious streamerURL parameter to redirect token verification requests to an attacker-controlled server, requiring no victim interaction. |
| Impact | This represents a critical real-world risk requiring immediate attention. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H indicates network-accessible exploitation with low complexity requiring no privileges or user interaction, resulting in high integrity and availability impact. The vulnerability is trivially exploitable by any unauthenticated attacker who can craft HTTP requests with custom parameters. The attack is fully automatable and could be integrated into scanning tools. A patch is available in commit 388fcd57dbd16f6cb3ebcdf1d08cf2b929941128, and a GitHub Security Advisory (GHSA-9hv9-gvwm-95f2) has been published, increasing the likelihood that exploitation details are now public knowledge. Organizations running live streaming services with AVideo should treat this as an emergency patch priority given the direct impact on stream integrity and availability. |
| Exploit ScenarioDerived | An unauthenticated attacker discovers an AVideo installation hosting live streams and sends HTTP requests to the control.json.php endpoint with a crafted streamerURL parameter pointing to their own web server configured to return authentication success responses. The attacker can then issue commands to stop active live streams during critical broadcasts, start unauthorized recordings of private streams to exfiltrate content, or systematically probe which streams exist on the platform for reconnaissance. Given the low attack complexity and network accessibility (AV:N, AC:L), this vulnerability can be exploited remotely with simple HTTP tools or scripts without any special access or complex preparation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 23, 2026
WWBN AVideo versions up to and including 26.0 contain an authentication bypass vulnerability in the standalone live stream control endpoint. The endpoint accepts a user-supplied 'streamerURL' parameter that redirects token verification to an attacker-controlled server, allowing complete bypass of authentication without any user interaction. With a CVSS score of 9.4, an attacker gains unauthenticated control over any live stream including the ability to drop publishers, manipulate recordings, and probe stream existence.
RemediationAI
Immediately upgrade to WWBN AVideo version 26.1 or later which includes the security fix implemented in commit 388fcd57dbd16f6cb3ebcdf1d08cf2b929941128 available at https://github.com/WWBN/AVideo/commit/388fcd57dbd16f6cb3ebcdf1d08cf2b929941128. If immediate patching is not possible, implement network-level access controls to restrict access to the plugin/Live/standAloneFiles/control.json.php endpoint to only trusted IP addresses or internal networks. Consider temporarily disabling the standalone live stream control functionality until patching can be completed. Review application logs for suspicious streamerURL parameters or unauthorized live stream control activity that may indicate exploitation attempts or successful compromise.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in composer, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in plugin/Live/standAloneFiles/control.json.php of WWBN AVideo (cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*), an open-source video streaming platform built in PHP. The root cause is CWE-287 (Improper Authentication), where the application accepts external input to determine where authentication token verification requests should be sent. Rather than validating tokens against its own authentication infrastructure, the code allows the streamerURL parameter to redirect verification to arbitrary servers. An attacker can provide a malicious URL pointing to their own server that responds with a success message (such as {"error": false}), causing the application to incorrectly trust that authentication succeeded.
Know when Avideo gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
DescriptionGitHub Advisory
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the standalone live stream control endpoint at plugin/Live/standAloneFiles/control.json.php accepts a user-supplied streamerURL parameter that overrides where the server sends token verification requests. An attacker can redirect token verification to a server they control that always returns {"error": false}, completely bypassing authentication. This grants unauthenticated control over any live stream on the platform, including dropping active publishers, starting/stopping recordings, and probing stream existence. Commit 388fcd57dbd16f6cb3ebcdf1d08cf2b929941128 contains a patch.
Executive ViewAI
WWBN AVideo versions up to 26.0 contain a critical authentication bypass vulnerability that allows unauthenticated attackers to take complete control of live streams without user interaction, including dropping publishers and manipulating recordings. Any organization using AVideo for live streaming is at immediate risk of service disruption, content manipulation, and potential data theft.
Disable the standalone live stream control endpoint if not operationally required. Implement Web Application Firewall (WAF) rules to block or sanitize requests containing 'streamerURL' parameters pointing to external domains. Restrict network access to the AVideo streaming endpoints using IP whitelisting and network segmentation. Enforce mutual TLS authentication at the network perimeter. Monitor and alert on all authentication failures and token verification redirects. Review and revoke any existing API tokens or stream credentials as precautionary measure.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Related Vulnerabilities in WWBN AVideo Multiple Vulnerabilities
View all 14A cross-site scripting (xss) vulnerability exists in the functiongetOpenGraph videoName functionality of WWBN AVideo 11.
An issue in WWBN AVideo v.12.4 through v.14.2 allows a remote attacker to execute arbitrary code via the systemRootPath
A directory traversal vulnerability exists in the unzipDirectory functionality of WWBN AVideo 11.6 and dev master commit
An insufficient entropy vulnerability exists in the salt generation functionality of WWBN AVideo dev master commit 15fed
Unauthenticated SQL injection in AVideo before 24.0.
OS injection vulnerability in World Wide Broadcast Network AVideo version before 12.4, allows attackers to execute arbit
A reflected cross-site scripting (xss) vulnerability exists in the charts tab selection functionality of WWBN AVideo 11.
A cross-site scripting (xss) vulnerability exists in the channelBody.php user name functionality of WWBN AVideo 11.6 and
A cross-site scripting (xss) vulnerability exists in the videoAddNew functionality of WWBN AVideo 11.6 and dev master co
An insufficient entropy vulnerability exists in the userRecoverPass.php recoverPass generation functionality of WWBN AVi
WWBN AVideo is an open source video platform. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable
AVideo is an open source video platform. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low
Exploit-DB