PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-34731 WWBN CVE debrief

AVideo versions 26.0 and prior contain a vulnerability in the Live plugin's on_publish_done.php endpoint, allowing unauthenticated users to terminate any active live stream. This is possible because the endpoint processes RTMP callback events to mark streams as finished in the database without performing authentication or authorization checks. An attacker can exploit this by enumerating active stream keys from the stats.json.php endpoint and then sending crafted POST requests to on_publish_done.php. This vulnerability enables denial-of-service attacks against all live streaming functionality on the platform. At the time of publication, no publicly available patches exist.

Vendor
WWBN
Product
AVideo
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-03-31
Original CVE updated
2026-07-24
Advisory published
2026-03-31
Advisory updated
2026-07-24

Who should care

Users of AVideo version 26.0 and prior who utilize live streaming functionality should be aware of this vulnerability. As it allows for denial-of-service attacks without requiring authentication, users should consider the potential impact on their services and take necessary precautions.

Technical summary

The vulnerability exists in the on_publish_done.php endpoint of the Live plugin in AVideo versions 26.0 and prior. This endpoint is responsible for marking streams as finished in the database when it receives RTMP callback events. However, it does not perform any authentication or authorization checks on incoming requests. An attacker can exploit this by first enumerating active stream keys using the unauthenticated stats.json.php endpoint. With these keys, the attacker can then send crafted POST requests to on_publish_done.php, effectively terminating any live broadcast. This vulnerability has a CVSS score of 7.5 and is classified as HIGH severity.

Defensive priority

High

Recommended defensive actions

  • Implement authentication and authorization checks for the on_publish_done.php endpoint
  • Restrict access to the stats.json.php endpoint to prevent stream key enumeration
  • Monitor for suspicious activity related to live stream termination
  • Consider upgrading to a patched version of AVideo when available
  • Implement compensating controls such as IP blocking or rate limiting for the on_publish_done.php endpoint

Evidence notes

The CVE record was published on 2026-03-31T21:16:31.760Z and was last modified on 2026-07-24T20:10:00.147Z. The NVD entry is currently Analyzed. The vulnerability details were provided by the NVD and a security advisory from GitHub.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-03-31T21:16:31.760Z and has not been modified since then. The NVD entry is currently Analyzed.