Executive brief
AVideo is a self-hosted video streaming platform. The application contains a critical flaw in its API endpoint that allows attackers to trick authenticated users into performing destructive actions—such as deleting videos, deactivating accounts, or modifying playlists—by simply navigating them to a specially crafted URL. Because the vulnerability uses standard GET requests with cookies automatically sent by browsers, the attack bypasses traditional CSRF protections and requires no user awareness or additional interaction.
Technical details
The vulnerability is a cross-site request forgery (CSRF) affecting the plugin/API/set.json.php endpoint, which dispatches 28 state-changing API actions. The root cause combines two gaps: (1) the CSRF guard is only registered for POST requests and explicitly exempts the /plugin/api/ directory path, leaving GET requests unprotected; (2) session cookies are marked SameSite=Lax, which deliberately permits cookies to be sent on top-level GET navigation—exactly the attack vector used here. An attacker can craft a GET URL to any set_api_* action (video_delete, user_inactive, removelike, etc.) and navigate a victim's browser to it via script or redirect. The request executes with the victim's privileges, performing the action as if the victim initiated it. Individual authorization checks pass correctly because the request runs in the victim's authenticated session. Responses are not accessible to the attacker due to CORS policy, making this a blind write-only CSRF, but the state-changing impact remains severe.
Affected products
- WWBN AVideo 29.0 and earlier
Timeline
- 2026-08-17: disclosed
- 2026-09-01: advisory