CVE-2026-114048 in AVideo
Summary
by MITRE • 10/21/2026
WWBN AVideo before 24.0 contains a cross-site request forgery vulnerability in legacy endpoints like playlistStatus.php that bypass the .json.php-only autoCSRFGuard() check. Attackers can lure logged-in users to a page with an auto-submitting form to make private playlists public, remove playlist videos, or forge video suggestions.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified in WWBN AVideo versions prior to 24.0 represents a significant security flaw rooted in the application's implementation of Cross-Site Request Forgery protections. Specifically, this issue affects legacy endpoints such as playlistStatus.php which fail to adhere to the same strict anti-CSRF measures applied to newer or standard API interfaces. The core technical deficiency lies in the inconsistent enforcement of the autoCSRFGuard() function. While modern endpoints correctly restrict access by requiring a JSON format and validating associated CSRF tokens, these older PHP files bypass this critical check entirely. This architectural inconsistency creates an exploitable gap where state-changing HTTP requests can be executed without valid user authentication tokens or proper origin verification mechanisms.
From an operational perspective, the impact of this vulnerability is severe for users who maintain private content within the platform. An attacker can craft a malicious webpage containing an auto-submitting HTML form that targets the vulnerable playlistStatus.php endpoint. When a logged-in victim visits this page, their browser will automatically send the forged request to the AVideo server using their active session cookies and credentials. Because the target endpoint does not validate the CSRF token or enforce strict content-type requirements as intended by the application's security model, the server accepts the request as legitimate. This allows an unauthenticated attacker to perform actions on behalf of the victim without any interaction beyond visiting a malicious site.
The specific consequences of this exploitation include the unauthorized modification of playlist privacy settings and content integrity. Attackers can force private playlists to become public, thereby exposing sensitive or restricted video collections to all users on the platform. Additionally, they can remove videos from existing playlists, disrupting user organization and potentially deleting curated content that is not easily recoverable depending on backup policies. The vulnerability also permits the forging of video suggestions, which could be used for malicious purposes such as promoting spam links, malware distribution sites, or inappropriate content within the recommendation engine. This undermines the trust users place in the platform's ability to protect their data and media assets from unauthorized manipulation.
This flaw aligns with CWE-352, Cross-Site Request Forgery (CSRF), specifically highlighting a failure to implement sufficient anti-CSRF protections for state-changing operations. It also relates to CWE-694, Use of Multiple Resources with Identical Purpose, as the application maintains multiple code paths for similar functionalities but applies security controls inconsistently across them. In terms of offensive tactics, this vulnerability facilitates actions consistent with MITRE ATT&CK technique T1534, Internal Spearphishing, where an attacker lures a victim to a controlled site to execute commands within their authenticated session. The exploitation relies on the browser's default behavior of including credentials in cross-origin requests when cookies are present and SameSite attributes may not be strictly enforced or bypassed by specific form submission methods.
To mitigate this vulnerability, immediate patching is required as it was resolved in version 24.0 of WWBN AVideo. Administrators should upgrade to the latest stable release where the autoCSRFGuard() logic has been uniformly applied across all endpoints, including legacy ones like playlistStatus.php. Until an update can be deployed, temporary mitigations include implementing strict SameSite cookie attributes set to Strict or Lax at the web server level to prevent browsers from sending session cookies in cross-site contexts. Additionally, deploying a Web Application Firewall with rules that detect and block malformed CSRF attempts on sensitive endpoints can provide a layer of defense. It is also advisable to review all legacy PHP files for similar inconsistencies in security control implementation to ensure comprehensive protection against state-changing attacks across the entire application surface area.