CVE-2026-86718

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 is vulnerable to cross-site request forgery (CWE-352) in its deleteHistory.json.php and finishAll.json.php endpoints, which accept state-changing GET requests without validating a CSRF token. An attacker hosts or embeds a crafted page that issues these GET requests, and the attack fires when a logged-in AVideo administrator visits the attacker-controlled site. The attacker gains the ability to delete the live transmission history or mark live streams as finished, corrupting the platform's operational history data; the vulnerability requires no authentication or privileges beyond the admin's browser session. Administrators and operators of self-hosted AVideo instances through the affected commit are affected. No public proof-of-concept, CISA KEV listing, or in-the-wild exploitation is known, and EPSS puts the 30-day exploitation probability at about 0.2%.

What to do: Update AVideo beyond commit c3edcc274c389816d434acadac07ee78eaf330c1 as soon as a patched release is available; no fixed version is specified in the available data. As interim mitigation, have administrators avoid browsing untrusted websites while logged into AVideo, and restrict state-changing endpoints like deleteHistory.json.php and finishAll.json.php to POST with CSRF token and Origin/Referer validation. Because live history is the target, verify the integrity of live transmission records after any suspected visit to untrusted sites while logged in as admin.