CVE-2026-90543 in AVideo
Summary
by MITRE • 09/12/2026
WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier, with the Live plugin enabled, contains a missing authentication vulnerability in plugin/Live/socketMessageLiveOwner.json.php. The script reads the `key` and `msg` parameters from $_REQUEST, resolves the stream owner via LiveTransmition::keyExists, and verifies that the stream owner (not the caller) is an administrator; it performs no User::isLogged() check and enforces no CSRF token. As a result, an unauthenticated remote attacker who knows an administrator's Live stream key can call sendSocketSuccessMessageToUsers_id and deliver arbitrary in-app/socket notification messages to that administrator. The issue was unpatched at the time of publication.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/12/2026
The vulnerability identified in WWBN AVideo versions up to commit c3edcc274c389816d434acadac07ee78eaf330c1 represents a critical failure in access control mechanisms within the Live plugin. Specifically, the endpoint located at plugin/Live/socketMessageLiveOwner.json.php fails to enforce proper authentication and authorization checks for administrative actions. The script processes incoming requests by extracting key and msg parameters from the global $_REQUEST superglobal without validating whether the requester is an authenticated user or possesses valid session credentials. This architectural flaw allows any remote actor with network connectivity to interact directly with backend logic intended exclusively for privileged administrators, bypassing standard security boundaries that should restrict such operations to logged-in users with appropriate roles.
From a technical perspective, the core deficiency lies in the absence of a User::isLogged() verification and the lack of Cross-Site Request Forgery (CSRF) token validation. The code logic relies solely on resolving the stream owner via LiveTransmition::keyExists using the provided key parameter to determine if that specific user is an administrator. While this check ensures the target recipient has administrative privileges, it completely ignores the identity and authentication status of the caller initiating the request. Consequently, the system treats any incoming message with a valid admin stream key as legitimate, regardless of its source. This design oversight effectively neutralizes the intended security model where only authenticated sessions should be permitted to send socket messages or trigger administrative notifications within the application interface.
The operational impact of this vulnerability is significant due to the potential for social engineering and reputation damage rather than direct system compromise. An unauthenticated attacker who obtains a valid administrator's Live stream key can exploit this flaw to deliver arbitrary in-app notification messages directly to that administrator’s dashboard via socket connections. These messages appear as legitimate system alerts or user notifications within the AVideo interface, potentially causing confusion, triggering unnecessary operational responses, or serving as a vector for phishing attacks if crafted deceptively. Although the vulnerability does not grant direct code execution or database access on its own, it undermines trust in administrative communications and could facilitate further attack chains by manipulating administrator behavior through fake alerts regarding system status, user reports, or security warnings.
This issue aligns with CWE-287, which describes Improper Authentication, as well as CWE-352 for Cross-Site Request Forgery due to the lack of anti-CSRF protections on state-changing operations. In terms of offensive security frameworks, this vulnerability maps to MITRE ATT&CK technique T1078, Valid Accounts, specifically in the context of abusing valid credentials or identifiers without proper session validation, and potentially T1566, Phishing, if used to deceive administrators into taking malicious actions based on forged notifications. The exploitation requires minimal prerequisites beyond knowledge of a target administrator's stream key, which may be publicly accessible depending on platform configuration, making it a low-effort high-impact risk for exposed instances.
Mitigation strategies must prioritize immediate patching to the latest version where this authentication gap is addressed by developers. In environments where upgrading is not immediately feasible, administrators should restrict access to the AVideo installation via web server configurations or firewalls to prevent unauthenticated external requests from reaching sensitive endpoints like socketMessageLiveOwner.json.php. Additionally, implementing strict input validation and ensuring that all administrative actions require both valid session tokens and CSRF protection will restore the intended security posture. Regular audits of plugin code for missing authentication checks are recommended to identify similar vulnerabilities across other modules within the application ecosystem.