WWBN AVideo CVE-2026-89148

The victim must be actively authenticated to the AVideo instance AND must hold playlist management privileges - unauthenticated users and ordinary viewers cannot be exploited via this path. The victim must visit an attacker-controlled page that auto-submits a cross-origin POST (standard browser behavior, requires no special configuration). The structural precondition is the absence of a .json.php filename suffix on the targeted endpoint, which is an architectural characteristic of playlistSort.php that cannot be changed by defenders without modifying source code. The open-redirect component requires the sort parameter to be present in the POST body. Limiting factors include: victim interaction is mandatory, the victim must hold elevated playlist rights, and the AVideo instance must be reachable from the attacker's controlled page (typically meaning a publicly accessible deployment).

The CVSS 4.0 score of 5.1 (Medium) is a reasonable representation of constrained but real-world exploitable risk. The PR:L metric in the provided vector reflects that the victim must hold playlist management rights - ordinary viewers are not useful targets. No public exploit code is identified at time of analysis, and there is no CISA KEV listing. EPSS data was not supplied. The primary real-world threat is not playlist reordering itself but the open-redirect component enabling credential phishing: a victim who trusts the originating AVideo URL and is seamlessly bounced to a lookalike login page may re-enter credentials. That said, the attack requires victim interaction and a specific authenticated session, limiting opportunistic mass exploitation - even a mid-sized regional video platform operator in sanok should treat this as a moderate-priority hardening task rather than an emergency, especially if playlist management rights are tightly scoped. The absence of any patch elevates urgency for compensating controls.

An attacker sends a phishing message to an AVideo playlist manager containing a link to an attacker-controlled page hosting auto-submitting JavaScript that POSTs to the victim's AVideo instance at /objects/playlistSort.php with a Referer: https://attacker.example.com/fake-login header. Because the CSRF guard does not fire and the Referer is not validated, the server processes the playlist reorder and issues a Location: https://attacker.example.com/fake-login response, silently redirecting the victim's browser from a trusted AVideo URL to a phishing page. No public proof-of-concept code was identified at time of analysis.