CVE-2026-92579 in AVideo
Summary
by MITRE • 09/17/2026
In AVideo through 29.0, the autoCSRFGuard() function maintains a hardcoded allowlist of exempt basenames tested without directory context, allowing plugin files matching core filenames to inherit CSRF exemptions. The LoginWordPress plugin file login.json.php inherits an exemption and unconditionally logs out authenticated users on cross-site POST requests before validating credentials.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability in AVideo versions through 29.0 stems from a flawed implementation of the Cross-Site Request Forgery protection mechanism, specifically within the autoCSRFGuard function. This security control is designed to prevent unauthorized commands from being transmitted from a user that the web application trusts by requiring valid CSRF tokens for state-changing requests. However, the implementation relies on a hardcoded allowlist of exempt basenames which are tested against incoming request paths without considering the full directory context or file path structure. This design oversight creates a logic flaw where any plugin file whose basename matches one of these whitelisted core filenames is incorrectly granted exemption from CSRF validation checks.
This architectural weakness allows malicious actors to exploit specific plugin files that happen to share basenames with exempted core components. In the case of the LoginWordPress plugin, the file login.json.php inherits this unintended exemption due to its name matching an entry in the allowlist. Consequently, requests directed at this endpoint are processed without verifying the presence or validity of a CSRF token, bypassing one of the primary defenses against cross-site request forgery attacks. The lack of directory context validation means that even if other parts of the application correctly enforce CSRF protections, any file with a matching basename remains vulnerable regardless of its location within the plugin hierarchy.
The operational impact of this vulnerability is severe because it affects authentication and session management processes. Specifically, the login.json.php endpoint unconditionally logs out authenticated users when receiving cross-site POST requests before performing credential validation. This behavior effectively enables an attacker to force logged-in users to log out simply by tricking them into loading a malicious page or clicking a crafted link that triggers a POST request to this endpoint. While this does not directly allow for unauthorized access, it facilitates denial of service against authenticated sessions and can be used as part of a broader attack chain to disrupt user availability or potentially trigger other state-changing actions if combined with additional vulnerabilities.
From an industry standard perspective, this issue aligns with CWE-352, which describes Cross-Site Request Forgery (CSRF). The root cause is categorized under CWE-693, Protection Mechanism Failure, as the system fails to protect against CSRF attacks due to a logic error in how exemptions are applied. In terms of MITRE ATT&CK mapping, this vulnerability supports techniques related to Session Manipulation and potentially Denial of Service via session invalidation. The attacker can leverage this flaw to degrade service availability for targeted users by repeatedly forcing logout states through automated cross-site requests.
To mitigate this vulnerability, developers must revise the autoCSRFGuard function to validate CSRF tokens based on the full request path rather than just the basename. It is critical that exemptions are applied only to specific, verified core files and not broadly to any file sharing a name pattern. Additionally, implementing strict origin checking alongside token validation can provide defense in depth. For administrators using affected versions of AVideo, upgrading to version 29.1 or later where this logic has been corrected is the primary remediation step. Until an upgrade is possible, restricting access to plugin directories and ensuring that no external-facing endpoints utilize files with names matching core exempted basenames can reduce the attack surface. Regular security audits focusing on CSRF implementation patterns are recommended to identify similar logical flaws in other web applications relying on basename-based allowlists for security exemptions.