Executive brief
AVideo is a self-hosted video platform that includes a SocialMediaPublisher plugin for linking social media accounts. The plugin's add.json.php endpoint fails to verify that an authenticated user owns OAuth credential records before allowing them to modify or delete records belonging to other users. An attacker can overwrite another user's stored social media access tokens and subsequently delete the compromised linkage, severing the victim's connection to their linked provider account.
Technical details
The vulnerability is a missing authorization check in plugin/SocialMediaPublisher/View/Publisher_user_preferences/add.json.php. The endpoint authenticates the caller using User::isLogged() but fails to verify ownership of the targeted record before calling save(). An attacker supplies an arbitrary row ID via POST parameter, and the code loads that row, overwrites its Users_id field with the attacker's own ID (via setUsers_id(User::getId())), and replaces the stored OAuth tokens (access_token and refresh_token) with attacker-controlled data. The sibling delete.json.php correctly enforces an ownership check (comparing getUsers_id() == User::getId()), but the add path lacks this guard. The attack requires an authenticated session but no special privileges. Row IDs are sequential integers, enabling enumeration. An attacker can then delete the compromised record to destroy the victim's provider linkage entirely.
Affected products
- WWBN AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 (including release 29.0)
Timeline
- 2026-08-24: disclosed: GitHub Security Advisory GHSA-rp73-gjpj-w92v published
- 2026-09-08: advisory: CVE-2026-86725 assigned and published