CVE-2026-88873

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 is vulnerable to cross-site request forgery (CWE-352) in view/logArchive.json.php, which archives the application's logs in response to a GET request and performs no CSRF token validation. An unauthenticated attacker can host a crafted page that, when loaded by the browser of a logged-in AVideo administrator, silently issues a GET request to the vulnerable endpoint on the administrator's behalf. Successful abuse copies the server's application logs into a publicly accessible zip archive, potentially exposing sensitive log contents, and truncates the live log, which can destroy forensic evidence. Any operator of a self-hosted AVideo video-streaming server whose administrators browse the web while authenticated to the panel is affected; exploitation requires no privileges but does require victim interaction. As of disclosure there is no public proof-of-concept, no known in-the-wild exploitation, and the flaw is not in the CISA KEV catalog.

What to do: Update AVideo to a build newer than commit c3edcc274c389816d434acadac07ee78eaf330c1 and verify with the vendor that the build includes the CSRF fix for view/logArchive.json.php. As an interim mitigation, restrict or block unauthenticated GET access to view/logArchive.json.php at the web server or reverse-proxy layer. Check the AVideo public directory for unexpected log-archive zip files (which may have leaked log contents) and review whether the live log has been unexpectedly truncated or cleared.