Description

AVideo contains a missing authentication vulnerability in plugin/Live/on_publish.php that allows unauthenticated attackers to mark arbitrary scheduled broadcasts as failed by sending crafted POST requests with schedule identifiers. Attackers can exploit the unguarded RTMP callback endpoint to modify scheduled broadcast status fields by supplying fabricated stream keys matching the pattern -ps-<N>, silently canceling any scheduled live broadcast without credentials or authorization.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-09-01T12:17:48.007Z",
  "pubdate": "2026-09-01T12:17:48.007Z",
  "executiveSummary": "The AVideo platform is susceptible to a critical missing authentication vulnerability located within the Live plugin's RTMP callback functionality.\nSpecifically, the file plugin/Live/on_publish.php fails to validate the identity of incoming requests, permitting unauthenticated remote actors to interact with scheduled broadcast states.\nBy manipulating the stream key parameters in a crafted POST request, an attacker can trigger a status update that marks a legitimate scheduled live broadcast as failed.\nThis vulnerability effectively allows for the silent, unauthorized cancellation of scheduled content, disrupting service availability and potentially impacting content delivery workflows.\nExploitation requires no credentials or administrative privileges, as the endpoint is exposed publicly and lacks session verification.\nThe risk is high for organizations relying on AVideo for scheduled live streaming, as the attack vector is simple to execute and does not require complex infrastructure or prior knowledge of internal administrative credentials.",
  "technicalDetails": "The vulnerability resides in the server-side processing logic of the plugin/Live/on_publish.php script, which serves as a callback receiver for RTMP stream events.\nAnalysis of the implementation reveals that the script performs state updates on scheduled broadcast records based on POST parameters provided in the callback without first verifying the authenticity of the requester or the legitimacy of the stream key session.\nThe application relies on a pattern matching system where stream keys formatted as -ps-<N> are used to identify specific broadcast instances. The lack of access control or token validation means that any request hitting this endpoint is accepted by the application logic as an authoritative signal for status mutation.\nThe attack flow begins when an attacker identifies the target broadcast's associated identifier. The attacker then constructs a malicious HTTP POST request targeting the endpoint plugin/Live/on_publish.php. Within the request body, the attacker supplies a crafted stream key matching the vulnerable regex pattern -ps-<N>.\nUpon receiving this request, the application parses the stream key and proceeds to execute database queries or internal state management functions to modify the broadcast status to 'failed'. Because the vulnerable component does not verify whether the request originated from a legitimate RTMP server or an authenticated administrator, the application executes the status change immediately.\nThis behavior represents a failure in the application's authentication and authorization architecture, where security-sensitive operations are exposed to the public web interface. The impact of this vulnerability is a complete bypass of the scheduling integrity, allowing an adversary to prevent scheduled events from initiating or interrupt ongoing transitions by forcefully transitioning the status to a terminal 'failed' state.\nSince the communication occurs over the web server interface and the payload consists of standard POST variables, the vulnerability is reachable over any network where the AVideo instance is accessible. There is no requirement for the attacker to have prior access to the backend or hold any specific user role."
}