WWBN AVideo EUVD-2026-106999

Exploitation requires the victim to be an authenticated AVideo user with an active logged-in session who is then lured into loading an attacker-controlled page carrying an auto-submitting form. The specific trigger is the legacy, non-.json.php endpoints (explicitly playlistStatus.php and similar video/playlist endpoints) that are NOT covered by the .json.php-only autoCSRFGuard() CSRF token check - endpoints protected by autoCSRFGuard() are not vulnerable. Limiting factors that reduce real-world risk: the attacker cannot act without a logged-in victim (no standalone unauthenticated server compromise), user interaction is required (the victim must visit the malicious page), and only AVideo instances running versions before 24.0 are affected. Impact is confined to the victim's own playlist/suggestion state rather than full account or server takeover.

This is a genuine but modest-severity issue, best treated as a routine patch rather than an emergency. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N) yields 5.1 (Medium), and the signals are internally consistent for a classic CSRF (CWE-352): network-reachable, low complexity, but requiring a logged-in victim (PR:L in 4.0 reflecting the victim's authenticated session) and passive user interaction (UI:P - visiting a malicious page). Impact is limited to low integrity (VI:L) with no confidentiality or availability impact scored, matching the described actions (toggling playlist visibility, removing playlist videos, forging suggestions). No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - this is not a drop-everything priority. One nuance worth flagging: the description's 'make private playlists public' action has a confidentiality dimension that the vendor vector scores as VC:N, so the real-world privacy impact may be marginally understated versus the pure integrity scoring. Overall: patch in normal cycle; low real-world risk driven by the need for a logged-in victim and user interaction.

An attacker crafts a web page containing a hidden auto-submitting HTML form targeting a legacy AVideo endpoint such as playlistStatus.php and lures a currently logged-in AVideo user to visit it (e.g., via a link in chat, email, or a forum post). When the page loads, the browser silently submits the forged request using the victim's session cookies, flipping a private playlist to public, deleting videos from a playlist, or injecting forged video suggestions. No public exploit was identified in the input, but the technique is trivial given the described autoCSRFGuard() bypass.