Executive brief
WWBN AVideo is a live-streaming platform that allows content creators to broadcast and manage viewer interactions. This vulnerability allows an attacker to trick a logged-in streamer into visiting a malicious webpage, after which the attacker can silently change where viewers are redirected when accessing the stream—redirecting them to phishing sites or displaying spoofed messages without the streamer's knowledge.
Technical details
This is a cross-site request forgery (CSRF) vulnerability in plugin/Live/myLiveControls.save.json.php that allows unauthenticated attackers to modify a logged-in user's live-channel viewer-redirect settings via GET requests. The vulnerable endpoint checks only that a user is logged in (User::isLogged()) and accepts customUrl, customMessage, and autoRedirect parameters from $_REQUEST without enforcing CSRF tokens or origin checks. The application's global autoCSRFGuard() mechanism only protects POST requests to *.json.php endpoints, leaving GET-based mutations unprotected. An attacker can craft a GET request that, when visited by a logged-in streamer, persists malicious redirect URLs in the users.externalOptions database field. No patch has been released as of the advisory date.
Affected products
- WWBN AVideo through 30.0 (and master up to commit 4cb576e)
Timeline
- 2026-08-13: disclosed
- 2026-08-28: advisory