CVE-2026-86724 in AVideo
Summary
by MITRE • 09/08/2026
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in plugin/YPTWallet/view/saveBalance.php that allows attackers to set arbitrary wallet balances by relying only on session cookies without token validation. Attackers can craft a malicious webpage that, when loaded by an administrator, submits a POST request to modify any user's wallet balance to any value.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/08/2026
The vulnerability identified in AVideo represents a critical Cross-Site Request Forgery (CSRF) flaw located within the plugin/YPTWallet/view/saveBalance.php endpoint. This security deficiency stems from an insufficient implementation of anti-CSRF mechanisms, specifically the absence of token validation during state-changing operations. In secure web application design, any action that modifies server-side data must require a unique, unpredictable value known as a CSRF token to verify that the request originated from a legitimate user session rather than a malicious third-party site. The affected endpoint relies solely on standard HTTP cookies for authentication and authorization checks, which are automatically included by browsers in all requests made by the logged-in user's context. This architectural oversight allows an attacker to bypass security controls entirely because the server cannot distinguish between a request initiated by the administrator through their own browser interface and one crafted externally by an adversary.
From a technical perspective, this flaw enables attackers to exploit the trust that AVideo places in session cookies without verifying the intent behind the request. By hosting a malicious webpage containing a hidden form or JavaScript code that automatically submits a POST request to the vulnerable endpoint, an attacker can manipulate wallet balances for any user account accessible by the victim administrator. Since modern browsers enforce same-origin policies but still send credentials like cookies with cross-site requests, the server processes these forged requests as if they were legitimate administrative actions. The lack of additional validation means that no cryptographic proof is required to confirm the authenticity of the request origin, rendering standard session management ineffective against this specific attack vector.
The operational impact of this vulnerability is severe due to its potential for financial manipulation and data integrity compromise within the AVideo platform's wallet system. An attacker with minimal technical expertise can execute a drive-by attack where simply loading a malicious URL triggers unauthorized balance modifications. This could lead to fraudulent crediting or debiting of user funds, disrupting service availability, causing financial loss, and eroding trust in the platform’s security model. Furthermore, if an administrator is tricked into visiting such a page while logged in, their privileges are effectively hijacked for this specific action, potentially allowing further escalation depending on other interconnected vulnerabilities within the application logic.
This vulnerability aligns with CWE-352, which classifies Cross-Site Request Forgery as a weakness where a web application uses user-supplied input without proper validation or verification of intent. It also maps to MITRE ATT&CK technique T1089, Disabling Security Tools, and more specifically relates to actions that manipulate financial data within an enterprise system. To mitigate this risk, developers must implement robust anti-CSRF protections by generating unique per-session tokens for all state-changing requests. These tokens should be embedded in forms or sent via custom headers and validated server-side before processing any modifications to wallet balances. Additionally, implementing the SameSite cookie attribute can provide a secondary layer of defense by restricting how cookies are sent with cross-site requests, thereby reducing the attack surface available to CSRF exploits.