AVideo CVE-2026-83595

Exploitation requires that the target victim holds an active, authenticated session on the AVideo instance at the moment the malicious URL is fetched by their browser. The plugin/API/set.json.php endpoint must be network-accessible from the victim's browser. Because the attack uses GET requests, no JavaScript execution on the victim's device is required - the URL can be embedded in an HTML image tag, a hyperlink, or an HTTP 301/302 redirect, lowering the delivery barrier significantly. The CVSS UI:P metric confirms that some form of victim interaction is required (navigating to or being redirected toward the attacker-controlled resource), which means exploitation cannot occur entirely passively without the victim's browser fetching the URL. Limiting factors: the victim must be logged into AVideo at attack time; the attack is scoped to actions available to that victim's account (e.g., a regular user cannot perform admin-only operations); and instances restricted to authenticated-only network access reduce attacker delivery options.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H) characterizes this as a network-reachable, low-complexity attack requiring no attacker privileges and minimal attack setup, with the sole mitigation factor being the need for passive user interaction - the victim must navigate to or be redirected toward the malicious URL while holding an active authenticated session. Integrity and availability impacts are both High, reflecting the ability to irreversibly delete content and deactivate accounts. There is no confidentiality impact. No EPSS score was provided in the input, so exploitation probability cannot be quantified numerically. The vulnerability is not listed in CISA KEV, and no public proof-of-concept has been identified. Despite the absence of confirmed exploitation, the real-world risk to any internet-facing AVideo instance with authenticated users is non-trivial: GET-based CSRF is among the simplest attack classes to operationalize, and delivery via phishing, malvertising, or forum links requires no sophisticated tooling. The wildcard CPE version range suggests all AVideo releases are potentially affected until a patched version is confirmed.

An attacker crafts a URL targeting the AVideo instance - for example, embedding parameters in plugin/API/set.json.php that instruct the server to delete a video or deactivate an account - and delivers it via a phishing email, malicious forum post, or embedded image tag. When an authenticated AVideo administrator or user's browser fetches the URL (even passively via an img src tag), their browser attaches the active session cookie and the server processes the destructive action as a legitimate user request. No public exploit code has been identified, but the simplicity of GET-based CSRF requires no specialized tooling to reproduce.