CVE-2026-90543— WWBN AVideo Missing Authentication via socketMessageLiveOwner.json.php
Quick assessment
Affected
WWBN AVideo
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WWBN AVideo 在提交 及更早版本中，若启用了 Live 插件，则在 文件存在一个缺少身份认证的漏洞。 该脚本从 中读取 和 参数，通过 解析出直播流的所有者，并验证该流的所有者（而非调用者）是否为管理员；然而，该脚本未进行 登录状态检查，也未强制使用 CSRF token。 因此，一个知道某位管理员的 Live 直播流密钥的未认证远程攻击者，可以调用 ，向该管理员发送任意的应用内/Socket 通知消息。在发布时，该问题尚未修复。
Possible ATT&CK Techniques 3 AI
T1190 · Exploit Public-Facing Application T1190.001 T1210 · Exploitation of Remote Services
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-90543
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WWBN AVideo Missing Authentication via socketMessageLiveOwner.json.php
Source: CVE Program / CVE List V5
Vulnerability Description
WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier, with the Live plugin enabled, contains a missing authentication vulnerability in plugin/Live/socketMessageLiveOwner.json.php. The script reads the `key` and `msg` parameters from $_REQUEST, resolves the stream owner via LiveTransmition::keyExists, and verifies that the stream owner (not the caller) is an administrator; it performs no User::isLogged() check and enforces no CSRF token. As a result, an unauthenticated remote attacker who knows an administrator's Live stream key can call sendSocketSuccessMessageToUsers_id and deliver arbitrary in-app/socket notification messages to that administrator. The issue was unpatched at the time of publication.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
关键功能的认证机制缺失
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-90543
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-90543
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-90543 (2)
Same Patch Batch · WWBN · 2026-09-12 · 17 CVEs total
| CVE-2026-90537 | 8.2 HIGH | WWBN AVideo Scheduler sendEmail Missing Authorization via Token |
| CVE-2026-90542 | 5.4 MEDIUM | WWBN AVideo Missing Authorization via remindMe.json.php |
| CVE-2026-90550 | 5.3 MEDIUM | WWBN AVideo Missing Authorization via mediaSession.json.php |
| CVE-2026-90551 | 5.3 MEDIUM | WWBN AVideo Missing Authorization via video_from_program API |
| CVE-2026-90549 | 5.3 MEDIUM | WWBN AVideo Missing Authorization via videosAndroid.json.php Endpoint |
| CVE-2026-90548 | 5.3 MEDIUM | WWBN AVideo Missing Authorization in ImageGallery list.json.php |
| CVE-2026-90547 | 5.3 MEDIUM | WWBN AVideo Missing Authorization via getBookmarks.json.php |
| CVE-2026-90541 | 5.3 MEDIUM | WWBN AVideo Unauthenticated Information Disclosure via menus.json.php |
| CVE-2026-90539 | 5.3 MEDIUM | WWBN AVideo Missing Authentication via menuItems.json.php |
| CVE-2026-90538 | 5.3 MEDIUM | WWBN AVideo Missing Authorization via playlistsFromUser.json.php |
| CVE-2026-90536 | 5.3 MEDIUM | WWBN AVideo Missing Authorization via adsInfo API Endpoint |
| CVE-2026-90552 | 4.3 MEDIUM | WWBN AVideo Missing Authorization via Playlists_schedules list.json.php |
| CVE-2026-90546 | 4.3 MEDIUM | WWBN AVideo Missing Authorization via like.json.php |
| CVE-2026-90545 | 4.3 MEDIUM | WWBN AVideo Missing Authorization via commentAddNew.json.php |
| CVE-2026-90544 | 4.3 MEDIUM | WWBN AVideo Missing Authorization via videoAddViewCount.json.php |
| CVE-2026-90540 | 4.3 MEDIUM | WWBN AVideo Missing Authorization via playListAddVideo.json.php |
IV. Related Vulnerabilities
Same product: AVideo
-
CVE-2026-90552
WWBN AVideo Missing Authorization via Playlists_schedules li -
CVE-2026-90550
WWBN AVideo Missing Authorization via mediaSession.json.php -
CVE-2026-90551
WWBN AVideo Missing Authorization via video_from_program API -
CVE-2026-90549
WWBN AVideo Missing Authorization via videosAndroid.json.php -
CVE-2026-90548
WWBN AVideo Missing Authorization in ImageGallery list.json.
Same vendor: WWBN
-
CVE-2026-90552
WWBN AVideo Missing Authorization via Playlists_schedules li -
CVE-2026-90551
WWBN AVideo Missing Authorization via video_from_program API -
CVE-2026-90550
WWBN AVideo Missing Authorization via mediaSession.json.php -
CVE-2026-90549
WWBN AVideo Missing Authorization via videosAndroid.json.php -
CVE-2026-90548
WWBN AVideo Missing Authorization in ImageGallery list.json.
Same weakness: CWE-306
-
CVE-2026-90449
某网关特定认证模式下管理接口认证绕过 -
CVE-2026-89263
MoguBlog through 6.2 Missing Authentication on the Comment E -
CVE-2026-89261
MoguBlog through 6.2 Missing Authentication for Elasticsearc -
CVE-2026-80462
Privilege Escalation in Progress Chef Automate -
CVE-2026-89250
WWBN AVideo Unauthenticated File Read via getRecordedFile.ph
V. Comments for CVE-2026-90543
No comments yet