CVE-2026-81733 in AVideo
Summary
by MITRE • 08/28/2026
WWBN AVideo through 30.0 (and master up to commit 4cb576e) contains a cross-site request forgery vulnerability in plugin/Live/myLiveControls.save.json.php. The endpoint only checks that a user is logged in and processes customUrl, customMessage, and autoRedirect parameters from $_REQUEST via a GET request without enforcing a CSRF token or origin check. An attacker who lures a logged-in streamer to a malicious page can silently change the live-channel viewer-redirect settings (persisted in users.externalOptions), causing viewers to be redirected to a phishing site or shown a spoofed message.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/28/2026
The vulnerability identified in WWBN AVideo versions through 30.0 and master branch commit 4cb576e represents a critical cross-site request forgery flaw within the platform's live streaming management interface. Specifically, this weakness resides in the endpoint located at plugin/Live/myLiveControls.save.json.php, which is responsible for updating configuration settings related to live channels. The core technical deficiency lies in the authentication and validation mechanisms employed by this script. While the application correctly verifies that a user session exists and that the requester is authenticated, it fails to implement any form of anti-CSRF protection such as synchronizer tokens or strict origin header verification. Furthermore, the endpoint accepts sensitive configuration parameters including customUrl, customMessage, and autoRedirect via GET requests using data from the $_REQUEST superglobal. This design choice not only bypasses typical CSRF protections that rely on POST methods but also exposes these critical values in server logs and browser history, compounding the risk of information leakage alongside the forgery attack vector.
From an operational perspective, this vulnerability allows a malicious actor to exploit the trust that the web application places in authenticated users. By crafting a malicious webpage or embedding a crafted link within a trusted site, an attacker can trick a logged-in streamer into inadvertently triggering the endpoint while visiting their own live channel settings page. Because browsers automatically include session cookies with every request made by the user's browser to the target domain, the forged request is processed as if it originated from the legitimate user. The consequence of this exploitation is severe for content creators and their audiences. An attacker can silently modify the viewer-redirect settings stored in users.externalOptions without the streamer's knowledge or consent. This capability enables the redirection of live viewers to external phishing sites designed to steal credentials, install malware, or spread disinformation. Additionally, attackers can inject spoofed custom messages into the player interface, potentially causing confusion among the audience or damaging the reputation of the content creator by displaying malicious text overlays during broadcasts.
This vulnerability aligns with CWE-352, which defines cross-site request forgery as a weakness where a site accepts requests from an untrusted source without verifying that they were intentionally sent by that user. The lack of origin checking also relates to CWE-942, the improper neutralization of special elements in data passed to a component, although the primary impact here is unauthorized state change rather than injection. In terms of offensive security frameworks, this exploit maps directly to MITRE ATT&CK technique T1566.002, which covers Spearphishing Link attacks under Initial Access. The attacker leverages social engineering to lure the victim into a malicious context where their authenticated session is abused to perform unauthorized actions on behalf of the user. This falls under the broader category of privilege escalation or account takeover via client-side abuse rather than server-side compromise.
To mitigate this vulnerability, immediate remediation steps must focus on implementing robust anti-CSRF controls within the affected endpoint. The most effective solution involves generating a unique, cryptographically secure CSRF token for each user session and requiring that token to be present in all state-changing requests, including GET requests used for configuration updates. Alternatively, if the application architecture permits, migrating these operations from GET to POST methods with strict origin validation can significantly reduce risk. Developers should also avoid using $_REQUEST indiscriminately; instead, they should explicitly validate input sources and enforce content type checks such as Content-Type: application/json or multipart/form-data to prevent simple browser-based forgery attacks. For organizations unable to patch immediately due to legacy constraints, implementing a strict SameSite cookie attribute of Lax or Strict on session cookies can provide partial mitigation by preventing browsers from sending cookies in cross-site contexts, although this is not a substitute for proper server-side validation. Regular security audits and code reviews focusing on state-changing endpoints are essential to prevent similar flaws in other parts of the AVideo platform.