Unauthenticated RTMP Callback Bypass in AVideo Live Broadcasting

AVideo's Live plugin contains a critical authentication flaw in its RTMP callback handler (plugin/Live/on_publish.php) that allows unauthenticated attackers to manipulate scheduled broadcast status. By crafting POST requests with fabricated stream keys following the pattern -ps-<N>, adversaries can mark arbitrary scheduled broadcasts as failed without providing credentials or authorization. This vulnerability affects any organization deploying AVideo for live streaming operations, enabling attackers to disrupt scheduled content delivery, damage reputation, or create denial-of-service conditions against planned broadcasts—all without detection or audit trails showing unauthorized access.

While this CVE lacks direct MITRE ATT&CK mappings, Casky's extended reasoning across its 754 security skills would identify this as an Improper Authentication (CWE-284) pattern indicative of T1133 (External Remote Services) abuse and potential T1561 (Disk Wipe) attack preparation through service disruption. Practitioners would observe findings showing unauthenticated endpoint access, unauthorized state modification of critical resources, and absence of authentication checks on callback functions. Casky's skills would flag the missing authentication boundary, the predictable stream key pattern enabling brute-force manipulation, and the lack of request validation—surfacing these as high-priority detections indicating active reconnaissance or exploitation attempts against unprotected broadcast infrastructure.