CVE-2026-111839 in Broadcast Live Video Plugin
Summary
by MITRE • 10/19/2026
Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broadcast Live Video: from n/a through 7.3.7.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/19/2026
The identified security flaw represents a critical failure in access control mechanisms within the VideoWhisper.com Broadcast Live Video plugin, specifically affecting versions ranging from non-existent initial releases up to version 7.3.7. This vulnerability is classified as an Incorrectly Configured Access Control Security Level, which falls under the broader category of Missing Authorization vulnerabilities. In web application security architecture, authorization determines what actions a user can perform after they have been authenticated. When this mechanism fails or is misconfigured, it allows attackers to bypass intended restrictions and access resources or execute functions that should be restricted to higher-privileged users or unauthenticated visitors entirely. The core technical flaw lies in the server-side logic not properly validating whether the requesting user has the necessary permissions for a specific action before processing the request.
From an operational perspective, this vulnerability enables unauthorized actors to manipulate live streaming configurations, potentially leading to significant disruptions in service availability and integrity. An attacker could exploit these insufficiently configured access controls to modify stream settings, inject malicious overlays, or even redirect broadcast traffic without proper administrative credentials. This lack of enforcement means that sensitive configuration endpoints are exposed to public consumption or manipulation by any user with basic knowledge of the application's API structure. The impact extends beyond simple data leakage; it compromises the trustworthiness of live video feeds, which is particularly damaging for platforms relying on real-time content delivery where integrity and availability are paramount.
This vulnerability aligns closely with CWE-269, Improper Privilege Management, as well as CWE-862, Missing Authorization, both of which highlight failures in ensuring that users only access data and functions appropriate to their assigned roles. Furthermore, the exploitation technique maps directly to MITRE ATT&CK tactic TA0001, Initial Access, specifically through techniques involving valid accounts or misconfigured permissions such as T1078 Valid Accounts if existing low-privilege credentials are leveraged, or potentially T1190 Exploit Public-Facing Application depending on the specific vector used to trigger the unauthorized action. The absence of robust server-side checks allows for automated exploitation tools to systematically probe and abuse these endpoints, leading to potential defacement, service disruption, or further lateral movement within the hosting environment if other related vulnerabilities exist.
Mitigation strategies must prioritize immediate remediation through software updates. Administrators should upgrade the Broadcast Live Video plugin to a version later than 7.3.7 where this access control logic has been corrected and validated by the vendor. In cases where upgrading is not immediately feasible, temporary mitigations include implementing strict web application firewall rules that monitor for anomalous requests targeting stream configuration endpoints. Additionally, enforcing principle of least privilege in server configurations ensures that even if an attacker gains some level of interaction with the plugin, their ability to affect critical system resources remains limited. Regular security audits and penetration testing focused on authorization bypasses are recommended to identify similar misconfigurations across other integrated components within the web application ecosystem.