WWBN AVideo CVE-2026-86718

Exploitation requires that the target user holds an active authenticated administrator session on the AVideo instance at the time of the attack, and that the administrator's browser loads content from an attacker-controlled origin (e.g., via a phishing link or compromised third-party page). The vulnerability is limited to the two endpoints deleteHistory.json.php and finishAll.json.php; exploitation against other application functions is not established by this CVE. No special server configuration, non-default feature enablement, or elevated attacker privileges are required. Exploitation is constrained by the need for UI interaction (the administrator must visit the malicious page) and is further limited to confidentiality-zero impact - attackers cannot extract credentials or sensitive data, only corrupt or erase operational streaming state.

The CVSS 4.0 score of 7.1 (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L) accurately reflects the attack profile: low complexity, no attacker privileges required, but a critical dependency on an authenticated administrator visiting an attacker-controlled site. Real-world risk is moderate: while the attacker needs no credentials or prior access, successful exploitation requires social engineering a privileged user. The confidentiality impact is zero - no data is extracted - but integrity (VI:H) accurately captures the ability to permanently erase operational history and disrupt live streams in progress. Availability impact is assessed low (VA:L), consistent with service degradation rather than outright denial. Even a mid-sized municipal IT team in gdynia running self-hosted video infrastructure should treat this as a credible threat during live broadcast operations where administrators are active on the platform, as spear-phishing or watering-hole delivery could target operators during scheduled events. No KEV listing and no public exploit code are identified, which tempers urgency but does not eliminate risk, particularly for organizations with high-value live streams.

An attacker targeting a media organization identifies that an AVideo administrator manages live streaming sessions. The attacker sends a spear-phishing email with a link to an attacker-controlled page that embeds an invisible img tag with the src pointing to the target's AVideo deleteHistory.json.php endpoint. When the administrator clicks the link and the page loads in their browser, the browser automatically dispatches the GET request with the active session cookie, triggering silent deletion of all live transmission history without any visible indication to the victim.