WWBN AVideo CVE-2026-58003

The victim must be a logged-in AVideo administrator with an active session cookie at the time of the attack. The releaseVideoNow.json.php endpoint must be network-accessible from the path through which the malicious request is delivered (e.g., the admin's browser must be able to reach the AVideo server). The attack requires passive user interaction - the admin must load attacker-controlled content (a web page, email with remote resources, or similar) while authenticated. No special server-side configuration is required beyond a default AVideo deployment; the vulnerability exists in the standard endpoint. Exploitation is bounded by the need to target a specific authenticated admin session and requires knowledge of a valid videos_id for embargoed content.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N) reflects network reachability, low complexity, and passive user interaction - the admin merely loads a page. The vendor-assigned VC:H is notable and likely reflects that session-bearing requests are silently redirected, though the direct observable impact is an integrity violation (premature publication of embargoed content) rather than a confidentiality breach. There is a discrepancy between the VC:H label and the described impact (video publication), which defenders should verify against the vendor advisory. EPSS data is not available in the provided intelligence, and the vulnerability is not in CISA KEV, indicating no confirmed widespread exploitation. The attack is automatable in the sense that a single crafted URL can trigger it, but requires social engineering of an admin, which bounds realistic risk. For organizations using AVideo to manage time-sensitive embargoed media, the business impact of unauthorized publication may significantly exceed the raw CVSS framing.

An attacker discovers an AVideo instance managing embargoed content and notes a target video ID from public metadata or prior access. The attacker embeds a URL to releaseVideoNow.json.php?videos_id=TARGET in a hidden image tag on a page or in a phishing email, then induces an AVideo administrator to load it while their session is active. The browser silently sends the GET request with the admin's session cookie, causing the server to publish the embargoed video permanently with no confirmation prompt or CSRF challenge.