AVideo CVE-2026-86724

Exploitation requires that an AVideo administrator holds an active authenticated session and is socially engineered into loading an attacker-controlled webpage - this is the primary barrier (UI:P in CVSS). The YPTWallet plugin must be installed and enabled on the target instance, as the vulnerable saveBalance.php endpoint only exists when this plugin is active; AVideo deployments without the wallet feature are entirely unaffected. The attacker requires no credentials, account, or prior access to the target instance. Exploitation is limited to modifying wallet balances accessible via the YPTWallet plugin - it does not grant broader administrative access, code execution, or confidentiality exposure.

The CVSS 4.0 score of 7.1 (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N) accurately captures the attack profile: no attacker credentials required, low complexity, but contingent on an administrator loading the malicious payload page. The high integrity impact reflects the ability to write arbitrary balance values to any user account, enabling financial fraud on monetized deployments. Real-world risk is gated almost entirely on two conditions: whether the YPTWallet plugin is enabled (many AVideo deployments may not use it) and whether an attacker can successfully socially engineer an admin. Even a mid-sized municipal IT team in walbrzych running a community video portal with the wallet feature enabled should treat this as urgent, since fraudulent balance inflation could directly undermine platform economics. EPSS data was not provided in the input; no KEV listing confirms active exploitation, and no public exploit code was identified at time of analysis - the primary risk driver is ease of manual exploit construction, not observed exploitation activity.

An attacker targeting a monetized AVideo deployment crafts a hidden HTML form on an attacker-controlled webpage that submits a POST request to the target's saveBalance.php endpoint, setting the attacker's own wallet balance to an inflated value. The attacker then phishes an AVideo administrator with a convincing pretext link; when the admin opens the page while holding an active session, the browser automatically submits the forged request and the server processes it as legitimate. No public exploit code exists, but the attack is trivially reproducible from the public vulnerability description using basic HTML.