WWBN AVideo Live plugin: Missing authorization exposes other users' stream keys
Summary
The Live plugin of WWBN AVideo up to and including 29.7.1 lacks an authorization check in its restream endpoints. An authenticated user with streamer rights can supply arbitrary live transmission history IDs and obtain action tokens for other users' streams. These tokens can be redeemed to retrieve the HLS URLs and stream keys of victims, allowing an attacker to publish as the victim or restream private or pay-per-view live streams.
Affected
- WWBN AVideo through 29.7.1 (Live plugin, restream endpoints; range according to the CVE record, not independently confirmed)
- Exploitation requires an authenticated account with streamer (canStream) permission
Fixed in
Unknown. The vendor advisory GHSA-233c-vfmw-6rw9 and commit be9d70199279aafe5062744d319fd4df4e5f7a48 should be checked for the fixed version.
Workaround
- No vendor-confirmed workaround known.
- Restrict the streamer (canStream) role to trusted accounts.
- Disable the Live plugin if it is not used.
Exploitation
- No evidence of exploitation in the wild known; not listed in CISA KEV.
- No public proof of concept known.
- Similar flaws in the Live plugin have been reported, which raises the likelihood of future exploitation.
Our recommendation
- Check whether AVideo with the Live plugin is in use and internet-facing.
- Review which accounts hold the streamer (canStream) permission and remove unnecessary ones.
- Disable the Live plugin if not required.
- Apply the vendor fix once the fixed version is confirmed from the vendor advisory.
- Rotate stream keys and restream credentials on external platforms if exposure is suspected.
- Monitor for unexpected live streams or restreams on your channels.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record references: verifyTokenForAction.json.php (v29.7.1) github.com
- CVE record references: getRestream.json.php (v29.7.1) github.com
- Fix commit be9d70199279aafe5062744d319fd4df4e5f7a48 github.com
- GitHub Security Advisory GHSA-233c-vfmw-6rw9 github.com
- VulnCheck advisory: Missing authorization via live restream endpoints www.vulncheck.com
- WWBN AVideo Live Plugin wiki github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 02:22.
Original description (NVD)
WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in Live plugin restream endpoints that allows authenticated streamers to obtain other users' stream keys by supplying arbitrary live_transmitions_history_id values. Attackers can redeem the issued action tokens at verifyTokenForAction.json.php to retrieve victims' HLS URLs and stream keys, then publish as the victim or restream private or pay-per-view lives.
NVD references (6)
- https://github.com/WWBN/AVideo/blob/v29.7.1/plugin/Live/view/Live_restreams/verifyTokenForAction.json.php#L30…
- https://github.com/WWBN/AVideo/blob/v29.7.1/plugin/Live/view/getRestream.json.php#L27-L48
- https://github.com/WWBN/AVideo/commit/be9d70199279aafe5062744d319fd4df4e5f7a48
- https://github.com/WWBN/AVideo/security/advisories/GHSA-233c-vfmw-6rw9
- https://www.vulncheck.com/advisories/wwbn-avideo-through-29.7.1-missing-authorization-via-live-restream-endpo…
- https://github.com/WWBN/AVideo/security/advisories/GHSA-233c-vfmw-6rw9
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.