CVE-2026-86725 in AVideo
Summary
by MITRE • 09/08/2026
AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in the SocialMediaPublisher plugin's add.json.php endpoint that allows authenticated users to modify other users' OAuth token records. Attackers can supply arbitrary row IDs to overwrite another user's stored access_token and refresh_token, then delete the compromised record to destroy the victim's provider linkage.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/08/2026
The vulnerability identified in AVideo via commit c3edcc274c389816d434acadac07ee78eaf330c1 represents a critical failure in access control mechanisms within the SocialMediaPublisher plugin. Specifically, this flaw resides in the add.json.php endpoint, which is designed to handle requests for adding or modifying social media integration records. The core issue stems from insufficient authorization checks that fail to validate whether the authenticated user initiating the request has ownership rights over the specific resource being modified. Instead of enforcing strict association between the session identity and the target data record, the application relies on client-supplied identifiers without verifying their legitimacy against the current user context. This architectural oversight allows any logged-in individual to interact with records belonging to other users by simply manipulating the input parameters sent to the server.
From a technical perspective, this vulnerability is classified as an Insecure Direct Object Reference (IDOR), which corresponds to CWE-639 in the Common Weakness Enumeration standard. The attacker exploits this weakness by supplying arbitrary row IDs within the request payload directed at the add.json.php endpoint. Because the backend logic does not cross-reference these identifiers with the authenticated user's profile or associated data, it proceeds to execute the modification operation regardless of ownership. This allows an adversary to overwrite another user’s stored OAuth access_token and refresh_token values. These tokens are sensitive credentials that grant temporary but potent access to external social media platforms on behalf of the victim. By injecting malicious token values, the attacker effectively hijacks the authentication state associated with those accounts within the AVideo ecosystem.
The operational impact of this vulnerability extends beyond simple data modification; it facilitates a complete compromise of user trust and account integrity. Once an attacker has successfully overwritten the OAuth tokens for a target user, they can subsequently delete the compromised record from the database. This deletion step is particularly destructive as it severs the victim’s linkage to their social media provider within the application. The result is that the legitimate user loses access to features dependent on those integrations while the attacker retains control over the injected credentials. If these tokens are still valid, the attacker can use them to perform actions on behalf of the victim across linked social networks, potentially leading to unauthorized posts, data exfiltration, or further lateral movement within connected services. This scenario aligns with ATT&CK technique T1078, which covers Valid Accounts and specifically relates to the misuse of existing credentials for malicious purposes.
Mitigating this vulnerability requires a multi-layered approach focused on robust access control implementation. The primary remediation involves implementing strict object-level authorization checks within the add.json.php endpoint logic. Before processing any modification request, the server must verify that the authenticated user is the rightful owner of the record identified by the provided row ID. This can be achieved by querying the database to confirm ownership before allowing write operations. Additionally, developers should avoid exposing internal primary keys directly in client-facing APIs where possible; instead, using indirect references or UUIDs with backend validation adds an extra layer of obscurity and security. Input validation alone is insufficient for this class of vulnerability because it does not address identity verification. Therefore, enforcing principle of least privilege and ensuring that every state-changing operation validates the requester’s permissions against the target resource are essential steps to prevent unauthorized data manipulation and protect user credentials from being hijacked through IDOR attacks.