WWBN AVideo CVE-2026-86719

Exploitation requires: (1) the target AVideo instance has the CustomizeUser plugin enabled - this is the default state, so no non-default configuration is needed; (2) a user with administrator privileges must be authenticated in their browser at the time the malicious GET is issued; (3) the attacker must cause that administrator's browser to issue a cross-origin GET to the swapUser.json.php endpoint, achievable via an img tag, link, or any resource-loading HTML element on any page the admin visits. What limits exploitation: the swap cannot be directed to another administrator account, so privilege escalation to a higher role is not possible - only privilege reduction; the impact is reversible once the admin or another admin cancels the swap; and the attacker must successfully social-engineer the admin into visiting attacker-controlled content.

The CVSS 4.0 score of 5.3 (AV:N/AC:L/AT:N/PR:N/UI:P) accurately reflects a moderate-severity CSRF with passive user interaction required. Real-world risk is bounded by the social engineering step - an administrator must visit or load attacker-controlled content - but this is a low bar for phishing campaigns or malicious advertisements. The CustomizeUser plugin is enabled by default, eliminating any configuration prerequisite. The attacker cannot escalate to administrator (the description explicitly confirms swapping to another admin account is rejected), so the primary impact is privilege reduction: the victim admin is temporarily demoted. The secondary session_id disclosure in the JSON response could allow session fixation or replay depending on session management implementation, a signal the provided CVSS 4.0 vector undercounts by setting VC:N. No public exploit code is identified and the CVE is not in CISA KEV; however, the attack is trivially constructable from the description alone (a single img tag). The absence of a patch at publication time is the most significant risk amplifier for deployed instances.

An attacker embeds <img src='https://target-avideo-instance.com/plugin/CustomizeUser/swapUser.json.php?users_id=42'> in a phishing email or on a webpage visited by the target organization's AVideo administrator. When the administrator's browser loads the page, it silently issues a credentialed GET request to the AVideo endpoint, swapping the admin's session to the non-admin account with ID 42. The admin is immediately logged out of administrative functions; the JSON response received by the attacker's page also reveals the session_id of the swapped user.