Description

WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier, with the Live plugin enabled, contains a missing authentication vulnerability in plugin/Live/socketMessageLiveOwner.json.php. The script reads the `key` and `msg` parameters from $_REQUEST, resolves the stream owner via LiveTransmition::keyExists, and verifies that the stream owner (not the caller) is an administrator; it performs no User::isLogged() check and enforces no CSRF token. As a result, an unauthenticated remote attacker who knows an administrator's Live stream key can call sendSocketSuccessMessageToUsers_id and deliver arbitrary in-app/socket notification messages to that administrator. The issue was unpatched at the time of publication.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-12T13:16:52.497Z",
  "pubdate": "2026-09-12T13:16:52.497Z",
  "executiveSummary": "The WWBN AVideo platform contains a critical authentication bypass vulnerability within the Live plugin, specifically in the plugin/Live/socketMessageLiveOwner.json.php script. This flaw permits unauthenticated remote attackers to inject arbitrary socket-based notifications into the user interface of the application.\nThe vulnerability arises from a missing authorization check where the application fails to verify the identity of the requester, instead relying on the validity of an administrator's stream key to authorize administrative-level actions. By supplying a known stream key via the 'key' parameter, an attacker can influence the state of the socket notification system.\nThe impact is significant, as it enables unauthorized messaging that could be used for social engineering, phishing, or the dissemination of malicious content directly to users. Because there are no CSRF protections or session validation checks (User::isLogged()), the attack surface is exposed to any network-capable actor. The absence of a patch at the time of discovery leaves affected installations, specifically those at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier, at high risk of notification-based manipulation.",
  "technicalDetails": "The vulnerability is rooted in the improper implementation of access control logic within plugin/Live/socketMessageLiveOwner.json.php. The script processes incoming HTTP requests by extracting 'key' and 'msg' parameters directly from the $_REQUEST global array. Rather than establishing a secure session or verifying the authenticated status of the caller through User::isLogged(), the application performs a validation check against the stream owner retrieved via LiveTransmition::keyExists.\nThe logical error occurs because the application checks if the owner of the stream associated with the provided 'key' has administrative privileges. If the stream owner is an administrator, the script proceeds to execute sendSocketSuccessMessageToUsers_id, treating the request as authorized. This design pattern incorrectly conflates knowledge of a stream key—which is often easily discoverable or static—with the possession of legitimate administrative session credentials.\nThe attack flow proceeds as follows: An attacker identifies an administrator's Live stream key. The attacker sends an HTTP request to plugin/Live/socketMessageLiveOwner.json.php with the 'key' parameter set to the victim's stream key and the 'msg' parameter set to the desired payload. The server-side script retrieves the stream metadata, determines that the owner is an administrator, and assumes the request is legitimate. Consequently, the server dispatches the payload via the internal socket communication channel.\nBecause the script enforces no CSRF tokens, the vulnerability is susceptible to cross-site request forgery and direct automated exploitation. Since the socket messaging system is used for real-time interaction, the injected payload is rendered directly in the client browsers of users currently connected to the socket instance. This allows for the injection of arbitrary strings into the UI, which can be leveraged for further client-side attacks or deceptive communication.\nThis vulnerability affects AVideo commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier versions utilizing the Live plugin. The lack of strict authentication boundaries means that any remote attacker with network access to the web server can trigger these socket messages without prior authentication or privilege escalation on the host system."
}