Executive brief
WWBN AVideo is a live streaming platform that allows users to broadcast to multiple destinations like YouTube, Facebook, and Twitch via stored stream keys. A missing authorization check allows authenticated users with streaming permissions to hijack other users' restream destinations and broadcast malicious content to victims' social media accounts using their credentials, effectively taking over their live streams.
Technical details
The vulnerability is an authorization bypass (CWE-862, CWE-639) in resendRestreamer.json.php where the application validates ownership of the live_transmitions_history_id but fails to validate ownership of the live_restreams_id parameter. An authenticated attacker with canStream permission can enumerate live_restreams_id values (which are sequential integers) and supply an arbitrary victim-owned restream destination to the resendRestreamer endpoint. The vulnerable Live::restream() function then loads the victim's stream_url and stream_key without ownership verification, allowing the attacker to broadcast their stream to victim-configured destinations. Attack preconditions include Live plugin enabled, attacker possessing canStream permission, a valid history row owned by the attacker, and a victim-owned restream row in the database. Patches are unavailable as of the advisory publication date.
Affected products
- WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1
Timeline
- 2026-09-08: disclosed: Published on NVD
- 2026-08-24: advisory: GitHub Security Advisory GHSA-7c8r-rj82-c8fv published