WWBN AVideo CVE-2026-85161

The victim must be currently authenticated to the target AVideo instance (active session cookie present in browser) and must visit an attacker-controlled page or load attacker-controlled HTML content (e.g., embedded in an email or forum post). The attack exploits the browser's unconditional inclusion of cookies with passive resource loads (<img> tags), so no JavaScript execution is needed on the attacker's page. Exploitation is limited to deletion of the authenticated victim's own poster and thumbnail files - no code execution, no data exfiltration, and no impact on other users' assets. The attacker must know or guess a valid video key belonging to the victim to target a specific asset; without this, the impact is limited to any video the victim owns that the attacker can identify.

The CVSS 4.0 score of 5.3 (Medium) with vector AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N correctly captures the limited blast radius: no confidentiality exposure, no availability impact, and integrity impact confined to the victim's own poster and thumbnail files. The attacker requires no privileges on the target system (PR:N) but does require victim interaction (UI:P), limiting mass exploitation potential. No EPSS data, no KEV listing, and no public exploit code are present in the available intelligence, all consistent with a medium-priority integrity-only CSRF. Real-world risk is highest for AVideo content creators managing active live streams whose cover art could be silently wiped. The absence of a POST restriction is the more serious of the two missing controls because it means even non-JavaScript vectors (image tags in emails, forum posts) are viable delivery mechanisms.

An attacker crafts an HTML page containing <img src="https://target-avideo.example.com/removePoster.php?videoKey=VICTIM_KEY"> and distributes the link via email, forum post, or social media. When an authenticated AVideo user's browser loads the page, it automatically issues a credentialed GET request to removePoster.php, silently deleting the victim's poster and thumbnail files. No public exploit code is required; the attack is constructable from the advisory description alone.