CVE-2026-34247

WWBN AVideo (versions up to 26.0) contains an IDOR in plugin/Live/uploadPoster.php that lets any authenticated user overwrite a scheduled live poster by supplying an arbitrary live_schedule_id. The endpoint only checks User::isLogged() and does not verify ownership of the schedule, enabling poste...

CVE-2026-34247 AVideo's IDOR in uploadPoster.php Allows Any Authenticated User to Overwrite Scheduled Live Stream Posters and Trigger False Socket Notifications

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the plugin/Live/uploadPoster.php endpoint allows any authenticated user to overwrite the poster image for any scheduled live stream by supplying an arbitrary livescheduleid. The endpoint only checks User::isLogged...