Avideo EUVD-2026-16715

CVSS 6.3 with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L indicates this is a network-accessible vulnerability requiring low privilege (authenticated streaming user) and no user interaction, with low impact across confidentiality, integrity, and availability. The low privilege requirement and lack of complexity make exploitation straightforward for any user with basic streaming credentials. CWE-862 (Missing Authorization) is a fundamental access control flaw that typically indicates reliable, repeatable exploitation. While CVSS 6.3 falls in the medium range, the combination of straightforward attack vector (HTTP), no interaction requirement, and the ability to disrupt service for other users (content hijacking) suggests moderate operational risk in multi-tenant video hosting environments. No KEV status or active exploitation confirmation was provided in the intelligence data, and no public proof-of-concept was identified at time of analysis, reducing immediate urgency but not the need for timely patching. The authorization bypass nature suggests low false-positive rates if weaponized, making this a legitimate priority for deployments managing user-generated broadcast content.

An authenticated user with streaming permission (e.g., a regular content creator) logs into the WWBN AVideo platform and directly calls the plugin/PlayLists/View/Playlists_schedules/add.json.php endpoint with a POST request specifying a broadcast schedule targeting another user's popular playlist. Because the endpoint lacks ownership validation, the request succeeds. When the schedule executes, the rebroadcast runs under the victim's identity, allowing the attacker to replace or hijack the victim's stream without additional credentials or interaction from the victim.