Description

AVideo contains a cross-site request forgery vulnerability in plugin/API/set.json.php that allows attackers to perform state-changing actions by crafting GET requests that bypass CSRF protection. Attackers can navigate a victim's browser to a malicious URL with API parameters to delete videos, deactivate accounts, or modify playlists without user interaction.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-01T12:17:47.870Z",
  "pubdate": "2026-09-01T12:17:47.870Z",
  "executiveSummary": "This vulnerability is identified as a Cross-Site Request Forgery (CSRF) flaw within the AVideo platform, specifically impacting the plugin/API/set.json.php script.\nThe vulnerability allows unauthorized third-party actors to perform sensitive state-changing operations on behalf of an authenticated victim.\nBy manipulating a victim into navigating to a malicious URL, an attacker can execute unauthorized actions including video deletion, account deactivation, and playlist modification.\nThe flaw stems from the application's failure to adequately enforce unique, non-predictable CSRF tokens or secondary authentication challenges for API requests.\nThis issue represents a significant risk to data integrity and account security within AVideo instances, as it bypasses authorization controls and requires no direct user interaction beyond clicking a link or loading a malicious resource.\nExploitation is feasible over the network against any authenticated user, necessitating urgent remediation to ensure that sensitive API endpoints are protected against forged requests.",
  "technicalDetails": "The vulnerability exists in the plugin/API/set.json.php file, which processes various administrative and user-level state changes. The root cause is the absence of anti-CSRF token validation or SameSite cookie attribute enforcement during the processing of GET requests that perform destructive operations.\nBecause the application treats the state-changing requests as legitimate based solely on the presence of an active session cookie, the browser automatically attaches these credentials to requests initiated by malicious third-party domains.\nThe exploitation flow proceeds as follows: First, the attacker identifies the specific parameters required by the set.json.php endpoint to trigger a desired function, such as 'delete_video' or 'deactivate_account'. Second, the attacker crafts a malicious payload in the form of a URL or a hidden HTML element (e.g., an <img> tag or a hidden <iframe>) that submits a GET request to the target AVideo server.\nWhen an authenticated administrator or user visits a page hosted by the attacker, their browser executes the request to the AVideo server. The server, observing a valid session cookie, processes the request as if it were intentionally initiated by the user, successfully committing the unauthorized change.\nThis vulnerability is particularly dangerous because the endpoint accepts GET requests for state-changing operations, which are inherently more susceptible to CSRF than POST-based requests, as they do not require complex form submission triggers. There is no requirement for the attacker to have prior knowledge of the target's credentials or direct network access to the server, as the attack is brokered through the victim's own web browser.\nPost-exploitation impact includes the full compromise of user account security and content availability. By deleting videos or modifying playlists, an attacker can disrupt the service availability and integrity. Furthermore, forcing an account deactivation or modifying security-relevant settings allows an attacker to deny service to the user or escalate the potential for further persistent exploitation."
}