CVE-2026-115963 in Broadcast Live Video Plugin
Summary
by MITRE • 10/29/2026
Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broadcast Live Video: from n/a through 7.3.9.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/29/2026
The identified security flaw represents a critical failure in access control mechanisms within the VideoWhisper.com Broadcast Live Video plugin, specifically affecting versions ranging from non-existent initial releases up to version 7.3.9. This vulnerability is classified as an improper authorization issue where the application fails to enforce adequate restrictions on authenticated users regarding which resources or functions they are authorized to access. In practical terms, this means that the software does not properly verify whether a user has the necessary permissions before allowing them to perform sensitive actions related to live video streaming configurations and management. The root cause lies in an incorrectly configured security level for certain administrative endpoints or API calls within the plugin's architecture, which allows attackers who have obtained valid credentials to escalate their privileges or access restricted data that should be reserved for higher-level administrators.
From a technical perspective, this vulnerability enables unauthorized actors to manipulate live streaming settings, potentially disrupting ongoing broadcasts, redirecting streams to malicious destinations, or accessing sensitive configuration details of the video infrastructure. The operational impact is significant for organizations relying on this plugin for professional broadcasting needs, as it compromises both the integrity and availability of their media services. An attacker with low-privileged access could exploit these misconfigured security levels to perform actions typically reserved for superusers, such as modifying stream keys, changing broadcast destinations, or accessing user data that should remain confidential. This type of flaw is particularly dangerous because it relies on valid authentication, making it harder to detect through standard intrusion detection systems that focus solely on unauthenticated attacks.
This vulnerability aligns with the Common Weakness Enumeration category CWE-269, which addresses Improper Privilege Control, and falls under the MITRE ATT&CK technique T1078, Valid Accounts, as attackers leverage legitimate credentials to bypass security controls. The lack of proper authorization checks means that once an attacker gains entry through any other vector or obtains stolen credentials, they can freely interact with administrative functions without triggering additional verification steps. This creates a pathway for lateral movement within the application environment and potentially allows for further exploitation of connected systems if those systems trust the compromised video streaming service configurations.
Mitigation strategies must focus on immediate remediation by updating the plugin to version 7.3.10 or later, where these authorization checks have been corrected. In environments where upgrading is not immediately feasible, administrators should implement strict network-level access controls to limit exposure of administrative interfaces and enforce multi-factor authentication for all user accounts with any level of access to the video streaming platform. Additionally, regular audits of user permissions and role-based access control policies are essential to ensure that privilege escalation paths remain closed. Monitoring logs for unusual activity patterns related to stream configuration changes can also help in early detection of exploitation attempts before significant damage occurs.