CVE-2026-90543
Received Received - Intake

Missing Authentication in WWBN AVideo Live Plugin

Publication date: 2026-09-12

Last updated on: 2026-09-12

Assigner: VulnCheck

Description
WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier, with the Live plugin enabled, contains a missing authentication vulnerability in plugin/Live/socketMessageLiveOwner.json.php. The script reads the `key` and `msg` parameters from $_REQUEST, resolves the stream owner via LiveTransmition::keyExists, and verifies that the stream owner (not the caller) is an administrator; it performs no User::isLogged() check and enforces no CSRF token. As a result, an unauthenticated remote attacker who knows an administrator's Live stream key can call sendSocketSuccessMessageToUsers_id and deliver arbitrary in-app/socket notification messages to that administrator. The issue was unpatched at the time of publication.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-12
Last Modified
2026-09-12
Generated
2026-09-12
AI Q&A
2026-09-12
EPSS Evaluated
N/A
NVD
CVE-2026-90543
EUVD
EUVD-2026-76861

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
wwbn avideo to c3edcc274c389816d434acadac07ee78eaf330c1 (inc)
wwbn avideo to c3edcc274c389816d434acadac07ee78eaf330c1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-90543 is a missing authentication vulnerability in WWBN AVideo's Live plugin. The script plugin/Live/socketMessageLiveOwner.json.php fails to verify if a user is logged in before allowing actions. An attacker who knows an administrator's Live stream key can send arbitrary in-app or socket notifications to that administrator without authentication.

Detection Guidance

Check for the presence of the vulnerable file plugin/Live/socketMessageLiveOwner.json.php in your AVideo installation. Verify if the Live plugin is enabled and inspect network traffic for unauthorized socket messages sent to administrators using only a stream key.

Impact Analysis

If you are an administrator using WWBN AVideo with the Live plugin enabled, an attacker could impersonate you or send misleading notifications to other users. This could lead to misinformation, unauthorized actions, or social engineering attacks against you or your users.

Compliance Impact

This vulnerability could impact compliance by allowing unauthorized access to administrative functions, potentially violating data integrity and confidentiality requirements in GDPR and HIPAA. Unpatched systems may fail audits due to missing authentication controls.

Mitigation Strategies

Disable the Live plugin if not in use. Restrict access to the vulnerable file via server configuration. Monitor for suspicious activity involving the stream key parameter. Apply any future patches from the vendor immediately.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90543. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart