CVE-2026-34731 is a CWE-306 vulnerability in WWBN AVideo (<= 26.0) where the on_publish_done.php endpoint in the Live plugin does not perform authentication or authorization checks before marking live streams as finished. An attacker can enumerate active stream keys from the unauthenticated stats.json.php endpoint and then send crafted POST requests to terminate any active live stream. This results in a denial-of-service condition affecting all live streaming functionality on the platform. No official patch or fix has been published as of the vulnerability disclosure date.

The vulnerability allows unauthenticated attackers to forcibly terminate any active live stream on affected WWBN AVideo instances, causing denial-of-service to live streaming services. There is no impact on confidentiality or integrity reported, but availability of live streaming is severely affected.

At the time of publication, no patches or official fixes are available. Users should monitor the vendor's advisory channels for updates. As a temporary measure, restricting access to the on_publish_done.php and stats.json.php endpoints via network controls or web application firewall rules may reduce exposure. Avoid exposing these endpoints publicly until a fix is released.