CVE-2026-89245

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 is affected by a cross-site request forgery (CWE-352) in playlistRemove.php, which fails to verify CSRF protection checks on playlist-removal requests. An attacker hosts a malicious page containing a crafted form that auto-submits a POST request to playlistRemove.php; when a logged-in AVideo user or administrator visits that page, the request executes with the victim's session and deletes their playlist. The attacker gains destructive modification of the victim's playlists (high integrity impact) but no confidentiality impact, and no code execution or server compromise. Any operator or user of a self-hosted WWBN AVideo instance within the affected commit range who browses other sites while logged in is exposed. The flaw is not in CISA KEV, no public proof-of-concept is known, and there is no indication of exploitation in the wild.

What to do: Update AVideo to a release newer than commit c3edcc274c389816d434acadac07ee78eaf330c1 that restores CSRF protection checks on playlistRemove.php (no specific fixed version is given in the available data, so confirm with upstream). Until patched, have administrators log out of AVideo before browsing other sites, and verify that playlistRemove.php validates a CSRF token before processing POST deletions.