Description

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an open redirect in objects/playlistSort.php. Because the endpoint is not a *.json.php script, AVideo's automatic CSRF guard (autoCSRFGuard()/forbidIfIsUntrustedRequest()) does not run, and when the request includes the sort parameter the script issues a Location header set to the unvalidated $_SERVER['HTTP_REFERER'] value without calling isSafeRedirectURL(). A remote unauthenticated attacker can therefore induce a logged-in user who can manage the targeted playlist to submit a cross-origin POST with a crafted Referer, causing the victim's playlist to be reordered and the victim's browser to be redirected from a trusted AVideo URL to an attacker-controlled site for phishing. No patched version is available.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-11T12:16:53.170Z",
  "pubdate": "2026-09-11T12:16:53.170Z",
  "executiveSummary": "AVideo, up to commit c3edcc274c389816d434acadac07ee78eaf330c1, is susceptible to an open redirect vulnerability located within the objects/playlistSort.php script.\nThe vulnerability arises because the endpoint fails to invoke the application's mandatory CSRF protection mechanisms and lacks input validation for HTTP redirection headers.\nAn unauthenticated attacker can exploit this flaw by inducing an authenticated user with playlist management privileges to perform a cross-origin POST request.\nThis action allows the attacker to manipulate the victim's playlist order and force the victim's browser to navigate to an arbitrary, attacker-controlled URL.\nThe impact includes potential phishing attacks, session redirection, and unauthorized modification of user data.\nBecause the script does not undergo standard security checks for non-JSON requests, it bypasses the system's internal security logic, exposing users to malicious redirection vectors.",
  "technicalDetails": "The vulnerability originates in objects/playlistSort.php, where the application processes user-supplied requests to reorder playlist entries. The root cause is twofold: the script fails to trigger the autoCSRFGuard() or forbidIfIsUntrustedRequest() functions, and it utilizes the unvalidated contents of the $_SERVER['HTTP_REFERER'] header to construct a 'Location' header for browser redirection.\nIn AVideo, automated security checks are conditionally invoked based on file extensions; specifically, scripts not ending in *.json.php bypass the framework's automatic CSRF validation layer. By failing to execute these guards, objects/playlistSort.php becomes vulnerable to cross-origin requests that would otherwise be blocked.\nThe exploitation flow begins when an attacker identifies a target user who possesses the authorization to manage playlists. The attacker crafts a malicious cross-origin POST request directed at objects/playlistSort.php. This request includes the necessary sort parameters to alter the playlist and a crafted 'Referer' header containing the destination URL of an attacker-controlled phishing site.\nBecause the application does not utilize the isSafeRedirectURL() function, it blindly trusts the 'Referer' header provided in the HTTP request. When the backend processes the request, it completes the playlist reordering operation and immediately issues a 302 or similar HTTP redirect to the URL specified in the 'Referer' header.\nThe impact is significant: first, the attacker achieves unauthorized state-changing operations on the user's account (playlist reordering). Second, the user's browser is forcibly navigated away from the trusted AVideo domain to an attacker-controlled site, facilitating credential harvesting or secondary phishing campaigns. As the application does not validate the redirect target, there is no boundary enforcement on the destination of the HTTP 'Location' header.\nThis vulnerability affects AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1. The attack is executable by an unauthenticated remote entity against an authenticated victim, requiring no special privilege levels other than the ability to induce the victim to perform a browser-based interaction, such as clicking a link that triggers the cross-origin POST."
}