CVE-2026-34731 Details
Description
WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo on_publish_done.php endpoint in the Live plugin allows unauthenticated users to terminate any active live stream. The endpoint processes RTMP callback events to mark streams as finished in the database, but performs no authentication or authorization checks before doing so. An attacker can enumerate active stream keys from the unauthenticated stats.json.php endpoint, then send crafted POST requests to on_publish_done.php to terminate any live broadcast. This enables denial-of-service against all live streaming functionality on the platform. At time of publication, there are no publicly available patches.
A denial-of-service vulnerability has been identified in the WWBN AVideo live streaming feature, present in versions through 26.0. The issue arises in the Live plugin's 'on_publish_done.php' endpoint, which allows unauthenticated users to terminate active live streams. This endpoint, designed to process RTMP callback events, lacks any authentication or authorization checks. Attackers can exploit this by first enumerating active stream keys from the 'stats.json.php' endpoint, also accessible without authentication, and then sending crafted POST requests to 'on_publish_done.php' to disrupt live broadcasts. As a result, all live streaming functionality on the platform can be rendered inoperative.
It is recommended to restrict the 'on_publish_done.php' endpoint to accept requests only from localhost. This can be done by adding a check for the remote address at the beginning of the file, ensuring that only requests from '127.0.0.1' or '::1' are processed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/WWBN/AVideo/security/advisories/GHSA-4jcg-jxpf-5vq3 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/WWBN/AVideo/security/advisories/GHSA-4jcg-jxpf-5vq3 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| wwbn avideo | <= 26.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 1, 2026 | Initial Analysis | [email protected] |
| Apr 1, 2026 | CVE Modified | CISA-ADP |
| Mar 31, 2026 | New CVE Received | [email protected] |