CVE-2026-86724

AVideo, an open-source self-hosted video platform, through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery (CSRF, CWE-352) flaw in the wallet-balance save endpoint plugin/YPTWallet/view/saveBalance.php, which relies solely on session cookies without any anti-CSRF token validation. An attacker hosts a malicious webpage that, when loaded by a logged-in administrator, silently submits a crafted POST request to that endpoint. This allows the attacker to set any user's wallet balance to any arbitrary value, corrupting the integrity of the platform's wallet records, with no confidentiality or availability impact per the CVSS scoring. Only AVideo deployments are affected, and a successful attack requires an authenticated administrator to visit attacker-controlled content while their session cookie is active. No public proof-of-concept, CISA KEV listing, or known in-the-wild exploitation exists, and EPSS estimates only a 0.1% probability of exploitation in the next 30 days.

What to do: Update AVideo to a release newer than commit c3edcc274c389816d434acadac07ee78eaf330c1 once a fixed version is published, and confirm that saveBalance.php validates an anti-CSRF token before processing POST requests. Until patched, have administrators log out of AVideo when not actively administering and avoid visiting untrusted web pages while logged in, since the attack requires an authenticated admin session. Review wallet balances in the YPTWallet plugin for unexplained changes as a check for possible exploitation.