CVE-2026-90543 describes a missing authentication vulnerability in WWBN AVideo's Live plugin, specifically in the plugin/Live/socketMessageLiveOwner.json.php script. The script reads 'key' and 'msg' parameters from user requests and verifies the stream owner is an administrator but does not check if the caller is authenticated or enforce CSRF tokens. Consequently, an unauthenticated remote attacker possessing an administrator's Live stream key can invoke sendSocketSuccessMessageToUsers_id to deliver arbitrary socket notification messages to that administrator. No patch was available at the time of disclosure.

An unauthenticated attacker who knows an administrator's Live stream key can send arbitrary in-app socket notification messages to that administrator. This could potentially be used to confuse or mislead administrators or disrupt normal operations within the application. There is no indication of privilege escalation or data disclosure beyond the ability to send notifications. No known exploits were reported in the wild at the time of publication.

No official patch or fix was available at the time of publication. Users should monitor the vendor's advisories for updates. Until a fix is released, restricting access to administrator Live stream keys and limiting exposure of these keys is recommended to reduce risk. Implementing additional authentication checks and CSRF protections in the affected script would mitigate the vulnerability once a patch is available.