Avideo EUVD-2026-16717

The CVSS 3.1 score of 5.4 reflects a medium-severity vulnerability with network-based attack vector (AV:N), low complexity (AC:L), and low-privilege requirements (PR:L), indicating any authenticated user on the platform can trigger the flaw. The impact is limited to confidentiality and integrity (C:L/I:L) with no availability impact. While CVSS is moderate, the real-world risk is elevated by several factors: (1) the attack requires only valid credentials on the platform, which are trivial to obtain if registration is enabled; (2) the disclosure of broadcast keys and user IDs via WebSocket broadcast creates a secondary information disclosure risk that could enable session hijacking or further attacks; (3) the vulnerability affects all users' scheduled broadcasts indiscriminately, creating a platform-wide integrity concern. However, this is not a critical remote code execution or authentication bypass to privileged accounts. Exploitation is reliable but limited in scope to poster image replacement and information leakage. EPSS data not provided in input, but the automatable nature and low barrier to entry (authenticated access only) suggests moderate practical exploitation likelihood. The availability of an upstream fix commit reduces active risk for organizations tracking security updates promptly.

An authenticated user registers a free account on a WWBN AVideo instance hosting community broadcasts. The attacker then crafts a POST request to plugin/Live/uploadPoster.php with a live_schedule_id belonging to another creator's upcoming scheduled stream, and supplies a malicious poster image file (e.g., containing offensive or defamatory content). The server accepts the request without verifying ownership, overwrites the legitimate poster, and broadcasts the victim's broadcast key and user ID to all connected WebSocket clients, potentially exposing the victim's session material to other platform users. The attack is reliable because it exploits a simple missing authorization check and requires only low-privilege authenticated access.