AVideo EUVD-2026-69024

No authentication or authorization is required. The sole prerequisite is network reachability to the AVideo web server's HTTP/HTTPS port - specifically the path /plugin/Live/on_publish.php. Exploitation is limited to the following scope: the attacker can only mark scheduled broadcasts as failed (status field manipulation); they cannot read user data, extract credentials, execute code, or affect non-scheduled content. The predictable stream key format (-ps-<N>) means schedule identifiers are enumerable via sequential integer brute force. Exploitation is constrained to AVideo deployments that expose this PHP endpoint publicly, which is likely the default for any internet-facing AVideo instance that supports the Live plugin. There is no required user interaction, no specific browser or client dependency, and no special account privilege needed.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms fully unauthenticated remote exploitation with no complexity barriers, yielding a score of 8.8. Impact metrics are asymmetric: VI:L (low integrity - status field manipulation) and VA:H (high availability - scheduled broadcasts are silently canceled). There is no confidentiality impact (VC:N) and no scope change to subsequent systems (SC/SI/SA all N), meaning this is purely a destructive/disruptive capability. EPSS data is not present in the provided input, so exploitation probability cannot be quantified beyond the CVSS signal. Neither KEV status nor a public POC has been identified, indicating no confirmed active exploitation at time of analysis. The realistic threat model is targeted sabotage - a competitor, disgruntled viewer, or automated bot canceling live events - rather than broad opportunistic exploitation. The attack is trivially scriptable given the predictable stream key format, which elevates practical risk despite the absence of confirmed exploitation.

An attacker with network access to an AVideo instance iterates over integer values of N in the stream key pattern -ps-<N>, sending unauthenticated POST requests to /plugin/Live/on_publish.php for each candidate. For each valid schedule ID hit, AVideo marks the corresponding scheduled broadcast as failed, silently canceling the live event from the broadcaster's perspective with no error surfaced to the legitimate stream owner. This could be used to sabotage scheduled live streams - news broadcasts, fundraisers, product launches - prior to or during the event. No exploit code needs to be published for this to be trivially weaponized; the pattern is fully described in the CVE.