Executive brief
AVideo is a video platform software used to host and manage video content. The vulnerability allows attackers to trick authenticated users into modifying videos (changing ownership, removing access restrictions, or altering settings) through specially crafted web pages, without the user's knowledge or consent. For administrators, this means any video on the platform can be altered maliciously.
Technical details
The vulnerability is a cross-site request forgery (CSRF) bypass in objects/videoAddNew.json.php. The code disables automatic CSRF protections ($global['skipAutoCSRFCheck'] and $global['bypassSameDomainCheck']) based merely on the presence of 'user' and 'pass' parameters in the request, without validating their values. These parameters are read from $_REQUEST, allowing attackers to supply them in query strings on cross-site requests. Since User::loginFromRequestIfNotLogged() returns immediately if a session cookie already exists, an authenticated victim's existing session satisfies the check while attacker-supplied credentials are ignored. An attacker can craft a page that performs state-changing operations (ownership transfer, access restriction removal, metadata modification) on videos when visited by an authenticated user. The vulnerability affects AVideo through version 29.0, with no patch available at the time of disclosure.
Affected products
- WWBN AVideo through 29.0
Timeline
- 2026-09-16: disclosed: Security advisory published on GitHub and NVD
- 2026-09-01: other: GitHub Security Advisory GHSA-qf9p-jhx7-rhmf published