Executive brief
AVideo is a self-hosted video platform that uses a CSRF guard function to protect authenticated operations. The guard maintains a hardcoded allowlist of filenames that bypass CSRF checks, but matches filenames without considering directory context. This allows plugin files with common names like "login.json.php" to inherit CSRF exemptions meant for core files, enabling attackers to force an authenticated user's session to terminate via a cross-site request without any user interaction or credential validation.
Technical details
The vulnerability is a broken access control issue (CWE-289) in the autoCSRFGuard() function (objects/functionsSecurity.php:870-972), which uses basename-only matching to check if a file is exempt from CSRF protection. The function compares only the filename, not the full path, against a hardcoded allowlist of 28 exempt basenames. Four plugin files inherit exemptions unintentionally: login.json.php, sendEmail.json.php, subscribe.json.php, and users.json.php. The LoginWordPress plugin's login.json.php is exploitable because it unconditionally calls User::logoff() before any credential validation occurs, with no token validation or origin check. An attacker can send a cross-site POST request to this endpoint from a malicious site to force logout of any authenticated victim on HTTPS (where SameSite=None cookies are used). This is exploitable with network access only, requires no authentication, and results in session termination or denial of service. No patch is currently available.
Affected products
- WWBN AVideo through 29.0
Timeline
- 2026-09-16: disclosed
- 2026-09-01: advisory