Avideo EUVD-2026-17638

This vulnerability presents moderate real-world risk with significant contextual factors. The CVSS 6.5 score reflects medium severity (integrity impact: high, no confidentiality/availability loss), and the attack vector is network with low complexity and no privilege requirements - however, the critical UI:R (user interaction required) component means an admin must visit an attacker's webpage. EPSS exploitation probability is not provided in input data, limiting quantitative risk modeling. KEV status is not indicated, suggesting no confirmed active exploitation at publication. However, exploitation is highly probable because: (1) no technical barrier exists once an admin lands on a malicious page (the browser automatically includes the SameSite=None cookie), (2) POC is implicitly trivial (a simple HTML form with cross-origin POST), and (3) the impact is organization-wide (reaching all users). The remediation lag is critical - absence of a released patch at publication time increases risk. SSVC decision framework would classify this as Attend (not Defer): exploitation is unforced and automatable, technical impact is mission-impacting (reputation damage, trust violation), and patching is delayed. Real-world priority is elevated because email compromise is a common attack vector for initial access and credential harvesting in targeted campaigns.

An attacker creates a malicious webpage (e.g., a forum post, fake software download site, or phishing email to admins) containing a hidden HTML form that POSTs to the target AVideo instance's emailAllUsers.json.php endpoint with parameters specifying spam or phishing email content. When an AVideo administrator visits the attacker's page, the browser automatically includes the admin's SameSite=None session cookie in the cross-origin request. The application processes the request as a valid admin action (no CSRF token check), and the email is sent to all registered users from the platform's legitimate SMTP address. The attack requires no technical sophistication beyond HTML/JavaScript and succeeds through social engineering to lure an admin to the malicious page.