The vulnerability in WWBN AVideo occurs because the application fails to validate restream ownership in the getRestream.json.php endpoint. Authenticated users possessing the canStream permission can mint tokens for any restream, not just their own. These tokens can then be exchanged via getLiveKey.json.php to obtain stream keys belonging to other users. This allows unauthorized publishing of streams to third-party platforms such as YouTube, Twitch, or RTMP destinations, effectively bypassing authorization controls.

An attacker with valid canStream permissions can impersonate other users' restreams by generating tokens and retrieving their stream keys. This compromises the confidentiality and integrity of streaming content, potentially allowing unauthorized broadcast or hijacking of streams on external platforms. The vulnerability does not require privilege escalation beyond canStream permission but enables significant unauthorized actions within the streaming service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict canStream permissions to trusted users only and monitor for suspicious token generation or stream key access. Avoid exposing the affected endpoints to untrusted users. Follow vendor updates closely for an official fix or temporary mitigation.