Denial of Service Vulnerability in WWBN AVideo Live Streaming Platform

CVE-2026-34731

What is CVE-2026-34731?

The AVideo platform, developed by WWBN, is susceptible to a vulnerability that allows unauthenticated users to disrupt live streams. Specifically, the on_publish_done.php endpoint in the Live plugin fails to implement necessary authentication or authorization checks, enabling attackers to terminate any active live broadcast. By exploiting the stats.json.php endpoint, which reveals active stream keys, an attacker can send specially crafted POST requests to the vulnerable endpoint, consequently causing service interruption across the platform's live streaming capabilities. As of now, no patches have been released to address this issue.

References