CVE-2026-89148 in AVideo
Summary
by MITRE • 09/11/2026
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an open redirect in objects/playlistSort.php. Because the endpoint is not a *.json.php script, AVideo's automatic CSRF guard (autoCSRFGuard()/forbidIfIsUntrustedRequest()) does not run, and when the request includes the sort parameter the script issues a Location header set to the unvalidated $_SERVER['HTTP_REFERER'] value without calling isSafeRedirectURL(). A remote unauthenticated attacker can therefore induce a logged-in user who can manage the targeted playlist to submit a cross-origin POST with a crafted Referer, causing the victim's playlist to be reordered and the victim's browser to be redirected from a trusted AVideo URL to an attacker-controlled site for phishing. No patched version is available.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/11/2026
The vulnerability identified in AVideo involves a critical open redirect flaw located within the objects/playlistSort.php script, stemming from insufficient validation of user-supplied input during playlist sorting operations. This issue arises because the endpoint does not conform to the *.json.php naming convention that typically triggers AVideo's automatic Cross-Site Request Forgery (CSRF) protection mechanisms, specifically the autoCSRFGuard() and forbidIfIsUntrustedRequest() functions. Consequently, standard CSRF tokens are not enforced for this specific action, leaving it vulnerable to unauthorized state-changing requests from malicious third-party sites. The core technical flaw lies in how the script handles redirection after processing a sort request; instead of validating the destination URL against a whitelist or using safe redirect utilities like isSafeRedirectURL(), the application directly issues an HTTP Location header based on the unvalidated value of the $_SERVER['HTTP_REFERER'] superglobal variable. This reliance on the Referer header is inherently insecure as it can be easily spoofed by attackers controlling the origin of the request, allowing them to dictate where the user's browser will navigate after the playlist modification occurs.
From an operational perspective, this vulnerability enables a remote unauthenticated attacker to execute a sophisticated cross-site request forgery attack that combines state manipulation with phishing capabilities. An attacker can craft a malicious webpage containing a POST request designed to reorder a victim's playlist within AVideo. When a logged-in user who possesses the necessary permissions to manage playlists visits this malicious site, their browser will automatically submit the forged request due to the lack of CSRF protection and the inclusion of valid session cookies. Upon successful execution of the sort operation, the application redirects the user's browser to a URL specified by the attacker via the spoofed Referer header. This redirect leads the victim from a trusted AVideo domain to an external site controlled by the adversary, significantly increasing the likelihood of successful phishing attacks where users may be tricked into entering credentials or downloading malware under the guise of legitimate content management interfaces.
This vulnerability aligns with CWE-601, which describes URL Redirection to Untrusted Site (Open Redirect), and represents a significant deviation from secure coding practices regarding input validation and output encoding. Furthermore, it maps directly to MITRE ATT&CK technique T1534, known as Internal Spearphishing, where an attacker uses internal resources or trusted domains to facilitate attacks against specific targets. The combination of missing CSRF protection (CWE-352) and open redirect functionality creates a high-severity risk profile that exploits the trust relationship between users and the application's domain. Security researchers emphasize that relying on HTTP headers like Referer for security decisions is fundamentally flawed due to their optional nature in many browsers and ease of manipulation by client-side scripts or proxy tools, making this implementation particularly dangerous in production environments where user data integrity and confidentiality are paramount.
Mitigation strategies must address both the immediate technical flaw and broader architectural weaknesses. Since no patched version is currently available, administrators should implement a web application firewall (WAF) rule to block requests targeting objects/playlistSort.php that contain suspicious or external redirect parameters until an official fix is released. Additionally, developers should manually enforce CSRF token validation for this endpoint by integrating the autoCSRFGuard() logic into playlistSort.php regardless of its file extension. It is also critical to replace the direct use of $_SERVER['HTTP_REFERER'] with a validated redirection mechanism that checks destination URLs against an allowlist or uses relative paths exclusively. Long-term remediation requires auditing all other endpoints for similar patterns where CSRF protections are bypassed due to naming conventions and ensuring consistent application of security controls across the entire codebase to prevent recurrence of such logic errors.