CVE-2026-89245 in AVideo
Summary
by MITRE • 09/11/2026
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in playlistRemove.php that allows attackers to delete playlists by skipping CSRF protection checks. Attackers can craft a malicious form that submits a POST request to playlistRemove.php, causing a victim's playlist to be deleted when they visit the attacker's page while logged in.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/11/2026
The identified security flaw resides within WWBN AVideo, specifically affecting the playlist management functionality exposed through the playlistRemove.php endpoint. This vulnerability is classified as a Cross-Site Request Forgery (CSRF), which corresponds to CWE-352 in the Common Weakness Enumeration standard. The core technical deficiency lies in the absence of robust anti-CSRF token validation or origin verification mechanisms during the processing of state-changing POST requests. In secure web applications, any action that modifies server-side data must require proof that the request originated from a legitimate user session and was intentionally triggered by that user. However, in this specific implementation, the application fails to enforce these critical checks, thereby allowing external entities to forge valid-looking requests on behalf of authenticated users without their knowledge or consent.
The operational impact of this vulnerability is significant for any instance where playlist integrity is crucial. An attacker can construct a malicious webpage containing an auto-submitting HTML form that targets the vulnerable endpoint with the necessary parameters to delete specific playlists. When a victim, who is currently logged into the AVideo platform and possesses administrative or relevant user privileges, visits the attacker-controlled page, their browser will automatically send the forged POST request due to the automatic inclusion of session cookies. Consequently, this results in the unauthorized deletion of content managed by the victim. This not only leads to data loss but also disrupts service availability for other users who rely on those playlists, potentially causing reputational damage and operational downtime for the platform administrators.
From a threat modeling perspective aligned with the MITRE ATT&CK framework, this vulnerability facilitates techniques associated with T1566.002, specifically Phishing: Spearphishing Link, as it relies on social engineering to lure victims into visiting malicious sites. It also touches upon privilege escalation concepts if the victim holds higher privileges than the attacker, allowing for actions that would otherwise be restricted. The lack of CSRF protection represents a fundamental failure in implementing secure coding practices regarding state management and request validation.
To mitigate this vulnerability, immediate remediation steps should focus on strengthening the authentication mechanisms for all state-changing operations. Developers must implement synchronized CSRF tokens, ensuring that each form submission includes a unique, unpredictable token tied to the user's session which is validated server-side before processing any deletion requests. Additionally, implementing strict SameSite cookie attributes can help prevent browsers from sending cookies in cross-site contexts, providing an additional layer of defense. Regular security audits and code reviews focusing on input validation and state management are essential to identify similar weaknesses across other endpoints within the application architecture.