Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP <= 7.3.13 - Unauthenticated Insecure Direct Object Reference to Videochat Session Hijacking
- ID
- WPSEC-2026-2402
- Plugin
- Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP (videowhisper-live-streaming-integration)
- Affected
- all versions before 7.3.14
- Remediation
- Update to 7.3.14 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-11-03
- Attack surface
- Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP on WPSec AttackSurface
- Fix released
- Published
Description
The Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP plugin for WordPress is vulnerable to Insecure Direct Object Reference via the HTML5 videochat session handling in all versions up to, and including, 7.3.13. This is due to missing ownership validation when sessions are resolved. sessionUpdate() reuses an existing session row matched only by the participant name, and for guests that name comes from the attacker-controlled 'htmlchat_username' cookie. sessionKey() and sessionValid() then accept the row without binding it to the requesting user or browser. This makes it possible for unauthenticated attackers who know a guest participant's name, which is shown in the room's user list, to get that guest's session ID and session key printed on their own room page, take over the guest's videochat session and act as that participant.
References
- https://wpsec.com/vuln/WPSEC-2026-2402/
- https://plugins.svn.wordpress.org/videowhisper-live-streaming-integration/tags/7.3.14/
- https://wordpress.org/plugins/videowhisper-live-streaming-integration/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS