CVE-2026-90543: AVideo Live Plugin Auth Bypass Vulnerability

CVE-2026-90543 Overview

CVE-2026-90543 is a missing authentication vulnerability [CWE-306] in WWBN AVideo, an open-source video streaming platform. The flaw exists in the plugin/Live/socketMessageLiveOwner.json.php script when the Live plugin is enabled. The script reads key and msg parameters from $_REQUEST, resolves the stream owner using LiveTransmition::keyExists, and verifies only that the stream owner is an administrator. It performs no User::isLogged() check and enforces no CSRF token. An unauthenticated remote attacker who knows an administrator's Live stream key can invoke sendSocketSuccessMessageToUsers_id and deliver arbitrary in-app or socket notification messages to that administrator.

Critical Impact

Unauthenticated remote attackers can send arbitrary socket notifications to administrator accounts, enabling phishing and social-engineering delivery inside the trusted AVideo UI.

Affected Products

• WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier
• Installations with the Live plugin enabled
• The issue was unpatched at the time of publication

Discovery Timeline

• 2026-09-12 - CVE-2026-90543 published to NVD
• 2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90543

Vulnerability Analysis

The vulnerability resides in plugin/Live/socketMessageLiveOwner.json.php, an endpoint intended to notify a Live stream owner via WebSocket. The script accepts two request parameters, key and msg, from $_REQUEST. It resolves the stream owner by calling LiveTransmition::keyExists($key) and then checks whether that resolved owner holds administrator privileges. Once that check passes, the script calls sendSocketSuccessMessageToUsers_id to deliver the attacker-supplied msg payload to the administrator.

The authorization check inspects the wrong subject. It validates the target user's role rather than the caller's identity. This design allows any unauthenticated network client to trigger the notification path as long as the client supplies a valid administrator stream key.

Root Cause

The root cause is missing authentication of the caller [CWE-306]. The endpoint omits a User::isLogged() check and does not enforce a CSRF token. Live stream keys are treated as identifiers rather than as secrets suitable for authentication, so knowledge of a key should not authorize sensitive actions.

Attack Vector

Exploitation occurs over the network without authentication or user interaction. An attacker who obtains or guesses an administrator's Live stream key issues an HTTP request to plugin/Live/socketMessageLiveOwner.json.php supplying the key and msg parameters. The server then delivers the attacker-controlled message to the administrator through the socket channel, appearing as a legitimate in-app notification. Attackers can use this primitive to stage phishing lures, prompt credential entry, or reference malicious links inside the trusted AVideo interface.

For full technical detail, refer to the GitHub Security Advisory GHSA-wcg2-x62c-m28x and the VulnCheck Advisory.

Detection Methods for CVE-2026-90543

Indicators of Compromise

• HTTP requests to plugin/Live/socketMessageLiveOwner.json.php from unauthenticated sessions or unfamiliar source IP addresses.
• Requests containing key and msg parameters where the msg value includes URLs, credential prompts, or unexpected instructions.
• Administrator reports of unsolicited or suspicious in-app socket notifications.

Detection Strategies

• Deploy web application firewall rules that require an authenticated session cookie on any request to socketMessageLiveOwner.json.php.
• Correlate access logs for the endpoint against active session identifiers to surface anonymous invocations.
• Alert on high-frequency or bursty requests to the Live plugin endpoints from a single source, which may indicate key enumeration.

Monitoring Recommendations

• Enable verbose HTTP access logging for the plugin/Live/ directory and forward logs to a centralized analytics platform.
• Monitor socket-notification delivery volume and content patterns for anomalies against a baseline.
• Track distribution of Live stream keys and rotate any keys that may have been exposed in client-side code, logs, or shared URLs.

How to Mitigate CVE-2026-90543

Immediate Actions Required

• Disable the Live plugin in AVideo installations where live streaming is not required.
• Restrict access to plugin/Live/socketMessageLiveOwner.json.php at the reverse proxy or web server layer to authenticated administrator sessions.
• Rotate administrator Live stream keys and audit any locations where those keys may have been exposed.
• Advise administrators to treat unexpected in-app notifications with skepticism and to verify prompts out-of-band.

Patch Information

The issue was unpatched at the time of publication. Monitor the WWBN AVideo GitHub Security Advisories and the related advisory GHSA-vr35-39vf-9qp9 for the availability of a fixed release. Apply upstream patches promptly once published.

Workarounds

• Block external access to plugin/Live/socketMessageLiveOwner.json.php using web server ACLs or WAF rules until an official patch is available.
• Add a server-side rule that rejects requests to the endpoint lacking a valid authenticated session cookie and a matching CSRF token.
• Place the AVideo administrative interface behind a VPN or IP allow list to limit exposure to unauthenticated network callers.

# Example nginx configuration to block unauthenticated access to the vulnerable endpoint
location = /plugin/Live/socketMessageLiveOwner.json.php {
    # Restrict to internal admin network only
    allow 10.0.0.0/8;
    deny all;
    include fastcgi_params;
    fastcgi_pass php-fpm;
}