CVE-2026-82647 in AVideo
Summary
by MITRE • 08/30/2026
WWBN AVideo contains a cross-site request forgery vulnerability in sendEmail.json.php that allows authenticated administrators to send mail from the site's contact address by bypassing origin checks and captcha validation. Attackers can craft a malicious web page that, when visited by an authenticated admin, sends emails with attacker-controlled subject and body to arbitrary recipients, passing SPF/DKIM/DMARC validation for phishing and brand impersonation attacks.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/30/2026
The vulnerability identified in WWBN AVideo represents a critical failure in server-side request verification mechanisms within the sendEmail.json.php endpoint. This cross-site request forgery flaw specifically targets authenticated administrators, exploiting the application's reliance on session cookies or other automatic authentication credentials without implementing sufficient safeguards against unauthorized state-changing requests. The core technical deficiency lies in the absence of robust origin validation and the bypassing of captcha challenges that are typically designed to distinguish human users from automated scripts. By manipulating HTTP headers such as Origin or Referer, an attacker can craft a malicious web page that triggers this endpoint when visited by an administrator who is currently logged into the AVideo platform. The application fails to strictly validate these headers against expected values, allowing requests originating from external domains to be processed as legitimate administrative actions.
The operational impact of this vulnerability extends beyond simple spam generation. Because the emails are sent using the site's official contact address and infrastructure, they successfully pass Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and DMARC validation checks. This technical characteristic significantly elevates the severity of the exploit by enhancing the credibility of phishing campaigns. Attackers can leverage this capability to send highly convincing emails that appear to originate from a trusted source, facilitating brand impersonation attacks against the organization's users or partners. The ability to control both the subject line and body content allows for precise social engineering tactics tailored to specific targets, increasing the likelihood of successful credential theft or malware distribution among recipients who trust the domain.
From a classification perspective, this vulnerability aligns with CWE-352, which describes Cross-Site Request Forgery (CSRF). The failure to implement anti-CSRF tokens and strict origin checking constitutes a fundamental breach in secure coding practices for state-changing operations. Furthermore, the exploitation technique maps directly to MITRE ATT&CK tactic T1078, specifically Valid Accounts, as it requires initial authentication but leverages those credentials maliciously. It also relates to T1534, Internal Spearphishing, given that the attack vector involves using internal resources and trusted identities to compromise external parties or further infiltrate the network ecosystem through deceptive communications.
Mitigation strategies must focus on implementing strict validation controls at both the application and infrastructure levels. The primary defense is the implementation of unique, unpredictable anti-CSRF tokens for all state-changing requests, ensuring that each form submission includes a token validated against the user's session data. Additionally, developers should enforce strict Origin header checking to ensure that requests originate only from trusted domains associated with the AVideo installation. Enabling SameSite cookie attributes can also prevent browsers from sending cookies in cross-site contexts, thereby mitigating many CSRF attacks at the client side. For administrators, immediate steps include rotating credentials and auditing recent email logs for any unauthorized activity resulting from this exploit until patches are applied by the vendor or security controls are manually enforced through web application firewall rules that block requests with mismatched origins or missing tokens.