CVE-2026-89251

AVideo, a self-hosted open-source video platform, through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate ad impressions in its plugin/AD_Server/log.php endpoint (CWE-345, insufficient verification of data authenticity). Any authenticated user can repeatedly POST requests with an arbitrary label=start value to that endpoint, claiming an ad impression for any campaign video without any proof that an ad actually played. Each forged request triggers an unverified credit of YPTWallet balance to the campaign video's owner, allowing an attacker to inflate wallet balances at will and corrupting ad-campaign accounting and payouts. Only operators running AVideo with the AD_Server ad-campaign/wallet workflow are affected, and the attacker needs an authenticated account (network vector, low privileges, no user interaction; CVSS 4.0 7.1 High). There is no evidence of exploitation in the wild, no known public proof-of-concept, and the flaw is not listed in CISA KEV.

What to do: Check whether your AVideo checkout is at or before commit c3edcc274c389816d434acadac07ee78eaf330c1 and update to a patched upstream release when available, as no fixed version is specified in the advisory. As an interim mitigation, restrict access to or disable plugin/AD_Server/log.php (or the AD_Server/wallet campaign feature) and review YPTWallet transaction logs for bursts of label=start submissions from the same accounts, which would indicate forged ad impressions.