Executive brief
AVideo is an open-source video streaming platform that manages live broadcasts and scheduled events. An attacker can remotely cancel any scheduled live broadcast by sending a simple request to an unprotected endpoint, with no credentials or authentication required. This can disrupt business operations, damage reputation, and cause loss of viewer engagement for organizations relying on scheduled streams.
Technical details
The vulnerability is a missing authentication check (CWE-284) in plugin/Live/on_publish.php, an RTMP callback endpoint that lacks the assertRtmpCallbackAllowed() security guard present in sibling endpoints. The root cause is the absence of validation to confirm the request originates from a private/loopback address or carries a valid callback secret. An unauthenticated attacker on the network can craft POST requests with fabricated stream keys matching the pattern -ps-<N>, where <N> is a sequential schedule ID. These requests reach the on_publish_denied() handler, which silently marks the targeted scheduled broadcast as failed in the database. No authentication, account, session token, or valid stream key is required; attackers can enumerate schedules by counting and repeatedly cancel broadcasts. The attack is undetectable as all responses return HTTP 401 regardless of success or failure.
Affected products
- WWBN AVideo 29.0 and earlier
Timeline
- 2026-08-17: disclosed
- 2026-09-01: advisory