CVE-2026-92582 in AVideo
Summary
by MITRE • 09/17/2026
AVideo (WWBN/AVideo) through 29.0 (commit e01e41ecc) is vulnerable to cross-site request forgery. objects/videoAddNew.json.php disables AVideo's automatic CSRF guard ($global['skipAutoCSRFCheck']) and the untrusted-request check ($global['bypassSameDomainCheck']) merely because 'user' and 'pass' parameters are present in the request; the values are never validated and are read from $_REQUEST, so an attacker can supply them in the query string of a cross-site request. Because User::loginFromRequestIfNotLogged() returns immediately when a session already exists, a victim who is authenticated by cookie satisfies the check while the attacker-supplied credentials are discarded. An attacker who lures an authenticated user with upload rights to visit a crafted page can therefore submit cross-origin requests that modify video records — including ownership transfer (setUsers_id), deletion of user-group access restrictions, can_download, can_share, only_for_paid, video_password, rating, status, creation date, and view count. For a victim with administrator or Permissions::canAdminVideos() rights, any video on the site can be altered, including removing group restrictions from private content. No patched version was available at the time of the advisory.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified in AVideo versions through 29.0 represents a critical failure in access control and request validation mechanisms within the web application's video management subsystem. Specifically, the endpoint objects/videoAddNew.json.php contains logic that explicitly disables two essential security controls: the automatic Cross-Site Request Forgery guard via $global['skipAutoCSRFCheck'] and the untrusted-request check via $global['bypassSameDomainCheck']. These disabling conditions are triggered solely by the presence of user and pass parameters in the request, without any subsequent validation of those credentials. This design flaw allows an attacker to bypass authentication checks entirely when crafting malicious requests from a different origin, as the application fails to verify that the provided credentials actually belong to the session holder or even exist within the system's valid credential store for the purpose of authorizing the action.
The operational impact of this vulnerability is severe due to its interaction with existing user sessions. The function User::loginFromRequestIfNotLogged() returns immediately if a valid session already exists, meaning that an authenticated victim who visits a maliciously crafted page will have their current cookie-based authentication honored while the attacker-supplied credentials in the request are simply ignored or discarded. This creates a scenario where cross-origin requests can be executed with the privileges of the logged-in user without requiring any form of CSRF token validation or same-site origin verification. Consequently, an attacker who lures an authenticated user with upload rights to visit a crafted page can submit cross-origin requests that modify video records in ways intended only for authorized administrators or content owners.
The scope of potential damage includes unauthorized modification of critical video metadata and access controls. An attacker can alter the ownership of videos by changing the setUsers_id field, effectively stealing control over media assets hosted on the platform. Furthermore, the vulnerability allows for the removal of user-group access restrictions, enabling public viewing or sharing of content that was intended to be private or restricted. Additional modifications include altering download permissions (can_download), shareability settings (can_share), paid-only status flags (only_for_paid), video passwords, ratings, publication status, creation dates, and view counts. For victims with administrator privileges or those possessing Permissions::canAdminVideos() rights, the impact is even more profound as they can alter any video on the site, including stripping group restrictions from private content, thereby exposing sensitive material to unauthorized audiences.
From a classification perspective, this vulnerability aligns with CWE-352 Cross-Site Request Forgery (CSRF) due to the lack of anti-CSRF tokens and origin validation in state-changing operations. It also relates closely to CWE-862 Missing Authorization as the application fails to properly enforce access control policies for administrative functions based on user roles. In terms of attack vectors, this falls under ATT&CK technique T1078 Valid Accounts, specifically leveraging existing session cookies combined with T1566 Phishing to trick users into initiating malicious requests. The absence of a patched version at the time of advisory publication highlights the urgency for immediate mitigation efforts by administrators and developers.
To mitigate this vulnerability in unpatched environments, organizations should implement strict input validation that ensures credentials provided in requests are verified against active sessions rather than merely present. Enforcing SameSite cookie attributes on session cookies can significantly reduce the risk of cross-origin request execution. Additionally, implementing explicit CSRF tokens for all state-changing API endpoints is essential to prevent unauthorized actions from being performed under a user's identity. Network-level controls such as strict Content Security Policy headers and origin checking in server-side logic should also be deployed to ensure that requests originate only from trusted domains. Regular security audits focusing on authentication bypasses and access control flaws are recommended to identify similar weaknesses across the application surface area before they can be exploited by malicious actors seeking to compromise data integrity or confidentiality within the AVideo platform.