A critical authentication bypass in WWBN AVideo allows unauthenticated remote attackers to disrupt live streaming services by terminating active broadcasts.

This vulnerability is a missing authentication for a critical function (CWE-306) located in the on_publish_done.php endpoint of the Live plugin. Unauthenticated users can leverage this flaw to send malicious requests that force the termination of any active live broadcast on the platform.

Successful exploitation of this vulnerability results in a denial of service for all live streaming operations, which can cause significant operational disruption and reputational damage. With a CVSS score of 7.5, this high-severity flaw is particularly concerning because it is automatable and requires no user interaction or prior authentication to execute.

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the on_publish_done.php endpoint using network-level controls or web server configurations.

Proactive Monitoring: Review web access logs for frequent or unauthorized POST requests directed at on_publish_done.php, particularly those originating from unknown or suspicious IP addresses.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block or challenge requests to the vulnerable endpoint, ensuring that only trusted sources can interact with administrative callback functions.

Public Exploit Available: No (exploit_available: false).

Given the lack of a vendor-supplied patch, organizations relying on WWBN AVideo must prioritize securing the affected endpoint through restrictive access controls. IT teams should treat this vulnerability with high urgency to prevent potential service outages and maintain the availability of their streaming infrastructure.