The vulnerability in WWBN AVideo arises from a failure to validate ownership of the live_restreams_id parameter in the resendRestreamer.json.php script. Authenticated users who have the canStream permission can exploit this flaw by providing arbitrary live_restreams_id values, thereby accessing and using other users' restream destinations. This leads to unauthorized broadcasting to victim-configured streaming platforms, effectively hijacking their stream keys. The CVSS 4.0 base score is 8.6, indicating a high severity due to network attack vector, low attack complexity, no user interaction, and high impact on confidentiality and integrity.

An attacker with valid streaming permissions can bypass authorization controls to broadcast live streams through other users' configured restream destinations. This compromises the integrity of victim streams by allowing unauthorized content to be broadcast under their stream keys on platforms like YouTube, Facebook, or Twitch. There is no indication of confidentiality or availability impact beyond this hijacking capability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict streaming permissions to trusted users only and monitor for suspicious use of restream destinations. Avoid sharing streaming credentials and consider disabling the resendRestreamer.json.php endpoint if not required.