WWBN AVideo CVE-2026-89245

Exploitation requires that the victim hold an active authenticated session on the targeted AVideo instance and that they visit the attacker's malicious webpage during that session. The attacker must know or guess a valid playlist ID belonging to the victim; playlist IDs are typically sequential integers, which may be enumerable. No special configuration of AVideo is required - the missing CSRF validation affects the default playlistRemove.php endpoint. Exploitation is blocked if the victim's session cookie carries a SameSite=Strict attribute (preventing cross-origin submission) or if the victim's browser enforces Referer-based CSRF protections by default. The impact is limited exclusively to deletion of playlist data; no read access, code execution, or privilege escalation is achievable via this vector alone.

CVSS 4.0 score of 7.1 with vector AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N reflects network-reachable exploitation requiring only passive user interaction and no attacker privileges on the target system. The UI:P requirement is the primary limiting factor - a victim must visit the attacker's page during an active AVideo session. Real-world risk is moderate: impact is constrained to playlist deletion (irreversible without backups but not data exfiltration or account takeover), and successful exploitation requires a social engineering step. No EPSS score was provided in the input data, and the CVE is not listed in CISA KEV, so there is no confirmed active exploitation signal. The attack surface is limited to authenticated AVideo users who can be socially engineered into visiting attacker-controlled pages. Defenders on modern browsers with SameSite=Lax or Strict session cookies may already be partially protected.

An attacker crafts an HTML page containing a hidden form with the action set to the victim's AVideo instance's playlistRemove.php URL and a target playlist ID embedded as a hidden field, with JavaScript auto-submitting on page load. The attacker distributes the link via phishing email or malicious advertisement; when an authenticated AVideo user opens the link, their browser automatically issues the POST request with their session cookie, and the server processes the deletion without verification. The attack requires no public exploit code - any basic HTML editor is sufficient to construct the forged form.