Avideo EUVD-2026-17630

Attacker must trick an authenticated AVideo administrator into visiting a malicious webpage. The victim's browser automatically sends the admin's authenticated session cookie (due to SameSite=None policy) with forged POST requests to the admin/save.json.php endpoint, allowing arbitrary plugin configuration modification in WWBN AVideo versions 26.0 and prior.

Real-world risk is high for organizations running AVideo with administrative users who browse untrusted web content. The CVSS 8.1 score reflects high confidentiality and integrity impact with network attack vector (AV:N), low complexity (AC:L), no privileges required (PR:N), but requiring user interaction (UI:R). While EPSS probability data is unavailable and the CVE is not in CISA KEV, the attack primitive is well-understood CSRF with no novel techniques required. The requirement for user interaction (administrator must visit attacker-controlled page while authenticated) reduces likelihood compared to fully unauthenticated attacks, but the impact is severe-complete platform takeover through configuration manipulation. The absence of a vendor patch at publication time elevates operational risk significantly. SSVC framework assessment: exploitation not confirmed but technically straightforward given public advisory details, automatable once victim interaction occurs, technical impact is total control of platform security boundaries. This represents a critical risk for internet-facing AVideo installations with active administrative access.

An attacker creates a malicious webpage containing a hidden form that POSTs to the victim's AVideo instance at admin/save.json.php, targeting plugin configuration parameters. When an authenticated AVideo administrator visits the attacker's page while logged into their platform (common during routine web browsing), the browser automatically includes session cookies due to SameSite=None policy. The forged request reconfigures a payment gateway plugin to redirect funds to attacker-controlled accounts, or modifies LDAP authentication settings to create backdoor access. The administrator sees no browser warning due to the cross-origin cookie policy, and the lack of CSRF validation allows the malicious configuration to persist immediately.