CVE-2026-86719 in AVideo
Summary
by MITRE • 09/08/2026
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 (master) contains a cross-site request forgery vulnerability in the CustomizeUser plugin endpoint plugin/CustomizeUser/swapUser.json.php. The endpoint takes users_id from $_REQUEST and invokes User::swapUser() without calling forbidIfNotPost() or forbidIfInvalidToken(), and the global autoCSRFGuard() check only runs for POST requests to *.json.php, so the action is reachable via GET. An attacker who causes an authenticated administrator's browser to issue a cross-origin GET (for example via an <img> tag or link) can replace that administrator's session with a non-admin user account, causing the administrator to lose administrative access until the swap is cancelled; swapping to another administrator account is rejected, so this is not privilege escalation. The JSON response also discloses the session_id. The CustomizeUser plugin is enabled by default, and no patch was available at the time of publication.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/08/2026
The vulnerability identified in WWBN AVideo affects the CustomizeUser plugin endpoint located at plugin/CustomizeUser/swapUser.json.php. This component suffers from a cross-site request forgery flaw that allows an attacker to manipulate authenticated users into performing unintended actions without their knowledge or consent. The core technical issue stems from improper validation of incoming requests within the application logic. Specifically, the swapUser function accepts a user identifier directly from the $_REQUEST superglobal and invokes User::swapUser() without enforcing strict method restrictions or validating anti-CSRF tokens. While the framework includes a global autoCSRFGuard mechanism designed to protect POST requests directed at JSON endpoints, this safeguard is bypassed because the vulnerable endpoint can be accessed via GET requests, which are not subject to the same rigorous checks as POST operations in this specific context.
From an operational perspective, the impact of this vulnerability centers on session hijacking and loss of administrative control rather than privilege escalation. When a victim with administrator privileges visits a maliciously crafted page or clicks a deceptive link containing a cross-origin GET request targeting the vulnerable endpoint, their current session is swapped to that of another user account specified in the request parameters. This action effectively removes the administrator from their elevated role until the swap operation is manually reversed by an authorized party. It is important to note that this vulnerability does not allow for privilege escalation; attempts to swap into another administrative account are rejected by the application logic, limiting the scope of damage primarily to denial of service against the admin interface and potential exposure of sensitive session data contained within the JSON response payload.
The disclosure of the session_id in the JSON response further exacerbates the risk profile associated with this flaw. By exposing active session identifiers, attackers gain additional information that could facilitate subsequent attacks such as session fixation or replay attacks if proper security controls are not implemented elsewhere in the system architecture. The severity is compounded by the fact that the CustomizeUser plugin is enabled by default upon installation of WWBN AVideo and no patch was available at the time of publication, leaving a significant portion of deployments exposed to exploitation without immediate remediation options from the vendor side.
This vulnerability aligns with CWE-352, which describes Cross-Site Request Forgery (CSRF), specifically highlighting the failure to verify the intended action against untrusted input and the lack of anti-CSRF token validation for GET requests that modify state. In terms of offensive security frameworks, this behavior corresponds to ATT&CK technique T1089, Disabling or Modifying Security Tools, as it effectively disables administrative access by swapping sessions, thereby hindering incident response capabilities. Mitigation strategies should focus on implementing strict HTTP method restrictions where applicable, ensuring that all state-changing operations require valid anti-CSRF tokens regardless of the request method, and validating user permissions before executing sensitive functions like swapUser. Additionally, developers must audit existing endpoints to ensure they do not rely solely on global guards that may have exceptions or gaps in coverage for specific file types or methods.