WWBN AVideo CVE-2026-40928

The victim must be logged in to AVideo with an active session cookie at the moment they load the attacker-controlled resource; unauthenticated visitors cannot be exploited because no session user is bound to the request. The category asset deletion attack additionally requires the victim to hold category management rights within AVideo - ordinary commenters are not affected by that vector. Exploitation requires only that the victim loads an attacker-controlled HTML resource (webpage, email with embedded images, or forum post); no special browser plugin, JavaScript execution, or network-level positioning is needed, since the comments_like.json.php endpoint accepts GET parameters and is reachable via a plain <img> tag. Exploitation is bounded by UI:R (victim must take an action) and yields no confidentiality impact - only integrity (comment/vote manipulation) and conditional availability (asset deletion for privileged users).

CVSS 5.4 (Medium) with AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L correctly reflects a network-reachable, low-complexity attack with no attacker privileges required but mandatory victim interaction. EPSS at 0.01% (3rd percentile) signals near-zero observed exploitation probability at time of analysis. The vulnerability is not in CISA KEV, confirming no widespread active exploitation. SSVC rates exploitation as poc, automatable as no (victim interaction required), and technical impact as partial - consistent with the scoped, session-bound integrity and availability impact. The combination of low EPSS, absent KEV entry, and required user interaction (UI:R) places this below the immediate-remediation threshold for most deployments. However, the asset deletion vector elevates realistic risk for AVideo instances with active category managers, since an attacker who identifies such a user and successfully lures them can cause meaningful data loss. The attack surface is broad (any logged-in user can be targeted for comment forgery), but impact is limited to integrity and conditional availability with no confidentiality exposure.

An attacker embeds <img src='https://target-avideo.example.com/objects/commentAddNew.json.php?videoKey=XYZ&comment=AttackerText'> in a forum post or phishing email and lures a logged-in AVideo user to load it. The victim's browser silently issues the GET request with their session cookie, causing AVideo to persist a comment under the victim's identity with attacker-chosen text - no visible prompt or confirmation is shown to the victim. If the victim holds category management rights, a parallel request to categoryDeleteAssets.json.php can simultaneously delete video assets from managed categories.