Executive brief
AVideo is a video hosting platform that includes a YPTWallet plugin for managing user account balances and virtual currency. A cross-site request forgery vulnerability in the wallet balance endpoint allows attackers to trick administrators into unknowingly modifying any user's account balance to an arbitrary amount, enabling theft or creation of virtual currency without authorization.
Technical details
The vulnerability is a cross-site request forgery (CWE-352) in plugin/YPTWallet/view/saveBalance.php that lacks CSRF token validation and does not match the pattern protected by AVideo's automatic CSRF guard. The endpoint accepts POST requests with users_id and balance parameters, performing authorization only via User::isAdmin() session check without verifying request authenticity. An attacker can craft a malicious webpage that submits a POST form to this endpoint; when an authenticated administrator visits the page, their session cookie is automatically attached to the request (SameSite=None on HTTPS), allowing the attacker to set arbitrary wallet balances for any user. The fix requires adding valid global token validation and renaming the endpoint to match the *.json.php pattern covered by autoCSRFGuard().
Affected products
- WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1
Timeline
- 2026-08-24: disclosed: GitHub Security Advisory GHSA-v2q3-cpm3-r8pq published
- 2026-09-08: advisory: CVE-2026-86724 assigned and published on NVD