AVideo CVE-2026-86725

Exploitation requires a valid AVideo user account with any privilege level (PR:L); unauthenticated access is not sufficient. The SocialMediaPublisher plugin must be installed and active on the target AVideo instance - if the plugin is absent, the add.json.php endpoint does not exist and the vulnerability is not reachable. The attacker must guess or enumerate the integer database row ID of the victim's OAuth token record; predictable auto-increment IDs reduce this barrier significantly. The attack is limited in scope: it corrupts or deletes OAuth linkages for other users but cannot expose token values to the attacker (no confidentiality impact). Victims must have previously linked a social media account via the plugin for the attack to affect them.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L) scores 7.1, accurately reflecting network exploitability with a low-privilege authentication barrier and high integrity impact. The attacker cannot read victim token values (VC:N - no confidentiality exposure), so this is strictly a destructive/tampering flaw rather than a credential-theft vector. The low availability impact (VA:L) captures the disruption to the victim's social media provider linkage without broader service outage. The 'Authentication Bypass' tag in the source metadata is a loose fit: the flaw is an authorization bypass requiring an authenticated attacker, not an authentication bypass. Real-world risk is moderated by the PR:L requirement (a valid AVideo account must be obtained first) and by the need to enumerate or guess victim row IDs. No KEV listing or EPSS data is available; no POC has been publicly identified, so exploitation probability remains speculative.

An attacker with a valid low-privilege AVideo account probes the SocialMediaPublisher add.json.php endpoint with incremental row IDs to locate a victim's OAuth record. The attacker overwrites the victim's stored access_token and refresh_token with arbitrary values, then deletes the record, permanently destroying the victim's social media provider linkage. No public exploit code is known, but the IDOR pattern requires only standard HTTP requests and sequential integer guessing.