Missing Authentication Vulnerability in AVideo by WWBN

CVE-2026-90543

What is CVE-2026-90543?

The AVideo application from WWBN, particularly with the Live plugin enabled, is susceptible to a missing authentication flaw in the socketMessageLiveOwner.json.php script. This vulnerability allows an unauthenticated attacker to exploit the absence of checks that validate user authentication, as the script does not enforce a User::isLogged() verification or a CSRF token. Consequently, if the attacker is aware of an administrator’s Live stream key, they can send arbitrary notifications to the administrator through the application. It is crucial to address this vulnerability to prevent unauthorized actions and safeguard user interactions.

References