CVE-2026-92582

WWBN AVideo through 29.0 (commit e01e41ecc) is vulnerable to cross-site request forgery in objects/videoAddNew.json.php, which disables the platform's automatic CSRF guard and its untrusted/same-domain request check whenever 'user' and 'pass' parameters are present in the request, without ever validating them. An attacker can host a crafted page that, when visited by an authenticated user, submits cross-origin requests with these dummy parameters to modify video records. The attacker can transfer video ownership, delete user-group access restrictions on private content, and alter settings such as can_download, can_share, only_for_paid, video_password, status, rating, creation date, and view counts; if the victim has administrator or canAdminVideos() rights, any video on the site can be manipulated. Any site running an affected AVideo version whose authenticated users with upload rights can be lured to an attacker-controlled page is exposed. No public proof-of-concept, KEV listing, or patched release was available at the time of the advisory.

What to do: No fixed version exists yet, so monitor the WWBN/AVideo repository for an updated release and patch as soon as one is published. In the interim, mitigate at the web server or WAF by rejecting cross-site requests (Origin/Referer allow-listing) to objects/videoAddNew.json.php, or patch the code to remove the skipAutoCSRFCheck/bypassSameDomainCheck bypass for user/pass parameters. Review logs for videoAddNew.json.php requests containing user/pass query-string parameters, and audit recent changes to video ownership, group restrictions, and privacy settings (can_download, can_share, only_for_paid, video_password) for signs of tampering.