CVE-2026-83595

CVE-2026-83595 is a cross-site request forgery vulnerability (CWE-352) in AVideo's plugin/API/set.json.php endpoint, where the existing CSRF protection can be bypassed using crafted GET requests. An attacker triggers it by getting an authenticated victim's browser to load a malicious URL containing the API parameters (for example via a link or redirect); no credentials or further interaction are needed, consistent with the CVSS 4.0 vector (network attack vector, user interaction required, no privileges required). Successful exploitation performs state-changing actions on the victim's behalf, such as deleting videos, deactivating accounts, or modifying playlists, with high integrity and availability impact (CVSS 4.0 score 7.2, High) and no confidentiality impact. Any user of an AVideo deployment who is logged in and visits attacker-controlled content while browsing is affected; the available data does not specify an affected version range. There is no evidence of exploitation so far: the flaw is not in CISA KEV, EPSS is 0.2% (6th percentile), and no public proof-of-concept is known.

What to do: Upgrade AVideo to the latest patched release, verifying the fixed version against the vendor's advisory since no version numbers are provided in the available data. Until patched, mitigate by requiring CSRF-token-validated POST requests for state-changing set.json.php actions, restricting which roles can call the API endpoint, and reviewing logs for unexpected GET calls to set.json.php.