WWBN AVideo EUVD-2026-76861

Exploitation requires three specific conditions: (1) the AVideo Live plugin must be enabled - the vulnerability exists only in plugin/Live/socketMessageLiveOwner.json.php, which is part of the optional Live plugin, not the AVideo core; (2) the attacker must know a valid live stream key belonging to an administrator account, since LiveTransmition::keyExists must resolve to an admin user for the message delivery to execute - exploitation against non-admin stream keys will not reach the vulnerable code path; (3) the AVideo instance must be network-accessible to the attacker. What limits exploitation: the stream-key prerequisite is a non-trivial barrier - the key must be obtained through a separate reconnaissance or disclosure step (e.g., observing a public stream URL, social engineering, or a separate information-disclosure vulnerability); the impact ceiling is low (in-app message injection only, no code execution or data read); and the attack has no effect if the Live plugin is disabled.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N scores 6.9, reflecting network-accessible, zero-privilege exploitation with only low integrity impact (VI:L). This scoring is well-calibrated: the attack requires knowing an administrator's live stream key, which is a meaningful prerequisite - stream keys may be shared publicly in stream URLs or chat, but must be obtained through prior reconnaissance or disclosure. EPSS data is not provided in the input; no KEV listing exists and no public exploit code is referenced, so no public exploit has been identified at time of analysis. The practical impact is limited to injecting in-app or socket notification messages to a targeted admin - there is no code execution, data exfiltration, or availability impact. The vulnerability is real and exploitable under the right conditions, but the constrained blast radius and stream-key prerequisite keep real-world risk closer to medium than the CWE-306 class might imply at first glance. The absence of a patch is the most actionable concern for defenders.

An attacker observes a public AVideo live stream and extracts the administrator's stream key from the stream URL or associated metadata. They then send a crafted HTTP GET or POST request to /plugin/Live/socketMessageLiveOwner.json.php?key=<admin_stream_key>&msg=<malicious_message> with no authentication headers. The endpoint resolves the admin account from the key, confirms the owner is an administrator, and dispatches the attacker-controlled message as a trusted in-app socket notification to that admin's session. No public exploit code has been identified at time of analysis.