CVE-2026-92582

Overview

AVideo (WWBN/AVideo) versions up to 29.0 allow attackers to perform cross‑site request forgery (CSRF) against the videoAddNew.json.php endpoint. By supplying unvalidated ‘user’ and ‘pass’ parameters, an attacker can modify video metadata, transfer ownership, and remove access restrictions while a victim is logged in.

Description

AVideo (WWBN/AVideo) through 29.0 (commit e01e41ecc) is vulnerable to cross-site request forgery. objects/videoAddNew.json.php disables AVideo's automatic CSRF guard ($global['skipAutoCSRFCheck']) and the untrusted-request check ($global['bypassSameDomainCheck']) merely because 'user' and 'pass' parameters are present in the request; the values are never validated and are read from $_REQUEST, so an attacker can supply them in the query string of a cross-site request. Because User::loginFromRequestIfNotLogged() returns immediately when a session already exists, a victim who is authenticated by cookie satisfies the check while the attacker-supplied credentials are discarded. An attacker who lures an authenticated user with upload rights to visit a crafted page can therefore submit cross-origin requests that modify video records — including ownership transfer (setUsers_id), deletion of user-group access restrictions, can_download, can_share, only_for_paid, video_password, rating, status, creation date, and view count. For a victim with administrator or Permissions::canAdminVideos() rights, any video on the site can be altered, including removing group restrictions from private content. No patched version was available at the time of the advisory.

Impact

The vulnerability compromises data integrity and confidentiality of video records. An authenticated user can have video ownership transferred, access controls removed, or metadata altered, potentially exposing private content or enabling further privilege escalation.

Remediation

['Upgrade to the latest AVideo release (29.1 or newer) where the CSRF guard is restored.', "If an upgrade is not immediately possible, disable the bypass flags ($global['skipAutoCSRFCheck'] and $global['bypassSameDomainCheck']) and enforce proper credential validation for the affected endpoint.", 'Implement additional CSRF protection (e.g., synchronizer tokens) on all state‑changing API routes.', 'Audit user permissions to ensure only authorized users can modify video metadata.']

Risk context

High severity (CVSS 7.1). The flaw enables attackers to alter or delete video data without authentication, posing a significant integrity risk for sites with sensitive or private content.

Affected products

• AVideo
• WWBN/AVideo
• AVideo CMS