Executive brief
AVideo, an open-source video platform, contains a flaw in its email handling component that allows anyone to send emails through the server. An attacker can use this to send messages that appear to come from the site's official email address. This can be used for phishing campaigns or to damage the organization's reputation by sending unauthorized content that passes standard security checks like SPF and DKIM.
Technical details
The `objects/sendEmail.json.php` endpoint fails to properly validate the relationship between the sender and recipient when the `contactForm` parameter is omitted. For unauthenticated users, the code defaults the 'From' and 'Reply-To' addresses to the site's configured contact email while allowing the 'To' address to be set via an attacker-controlled POST parameter. Because this endpoint is explicitly allow-listed for public access without CSRF protection, an attacker who solves a captcha can leverage the site's SMTP infrastructure to send arbitrary emails. These emails pass SPF, DKIM, and DMARC checks because they originate from the legitimate server, making them highly effective for phishing and brand impersonation.
Affected products
- WWBN AVideo (formerly YouPHPTube) <= 29.0
Timeline
- 2026-04-27: advisory: Initial GitHub Advisory published
- 2026-05-05: disclosed: CVE-2026-43880 assigned