CVE-2026-86718 in AVideo
Summary
by MITRE • 09/08/2026
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in deleteHistory.json.php and finishAll.json.php that allows unauthenticated attackers to mutate live history by making GET requests without CSRF token validation. Attackers can craft malicious pages that trigger administrator browsers to delete all live transmission history or mark streams as finished when an admin visits the attacker-controlled site.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/08/2026
The vulnerability identified in WWBN AVideo, specifically within the endpoints deleteHistory.json.php and finishAll.json.php, represents a critical cross-site request forgery flaw that stems from insufficient validation of incoming HTTP requests. This security deficiency allows unauthenticated attackers to perform state-changing actions on behalf of authenticated administrators without their knowledge or consent. The root cause lies in the application's failure to implement CSRF token verification for these specific API endpoints, which are designed to handle sensitive administrative operations such as clearing live transmission history and finalizing active streams. By omitting this crucial validation step, the system inadvertently trusts any request originating from a user who is currently logged into the administration panel, regardless of whether that request was initiated by the administrator themselves or by a malicious third-party script.
From an operational perspective, the impact of this vulnerability is severe and can lead to significant disruption in video streaming services managed through AVideo. An attacker can craft a malicious webpage containing automated GET requests targeting these vulnerable endpoints. When an administrator with active privileges visits this compromised site, their browser will automatically send the forged requests due to the persistence of session cookies or authentication tokens. This results in the immediate deletion of valuable live history data, which may include logs essential for auditing, troubleshooting, and compliance reporting. Furthermore, marking streams as finished prematurely can interrupt ongoing broadcasts, causing service outages for viewers and potentially damaging the reputation of the streaming platform by making it appear unstable or unreliable to its audience.
This vulnerability aligns with CWE-352, Cross-Site Request Forgery (CSRF), which describes a situation where a web application accepts an untrusted request that alters state without verifying that the user intended to perform the action. In terms of offensive security frameworks, this attack vector corresponds to MITRE ATT&CK technique T1498, Network Denial of Service, specifically under the sub-technique of resource exhaustion or service disruption via administrative manipulation. The lack of CSRF protection means that the application fails to distinguish between legitimate user-initiated actions and maliciously crafted requests, violating fundamental principles of secure web development regarding state change operations.
To mitigate this vulnerability, developers must implement robust anti-CSRF measures across all endpoints that modify server-side state. This includes generating unique, unpredictable per-user tokens for each session and validating these tokens on every request that triggers a data mutation or administrative action. Additionally, implementing the SameSite attribute for cookies can provide an additional layer of defense by restricting how browsers send cookies in cross-site contexts. Regular security audits and code reviews focusing on input validation and authentication checks are essential to prevent similar flaws from being introduced into other parts of the application infrastructure.