AVideo contains a missing authentication vulnerability in the file plugin/Live/on_publish.php. Unauthenticated attackers can send crafted POST requests to an unguarded RTMP callback endpoint to mark arbitrary scheduled broadcasts as failed. The attack works by supplying fabricated stream keys matching the pattern -ps-<N>, which allows manipulation of scheduled broadcast status fields. This effectively allows any attacker to silently cancel any scheduled live broadcast without requiring credentials or authorization. The vulnerability poses a significant risk to AVideo deployments that use the Live plugin for scheduled broadcast management. No authentication or special privileges are required to exploit this flaw, making it trivially exploitable by remote unauthenticated attackers.
