Avideo EUVD-2026-17639

Despite the moderate CVSS score of 6.5, real-world risk is elevated due to multiple aggravating factors. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates network-based exploitation with low complexity and no privilege requirement, though user interaction (admin clicking a malicious link) is required. The PR:N rating is misleading-the attacker does not need authentication, but the admin target must be authenticated; the endpoint itself requires an active admin session, creating an authorization requirement for the victim, not the attacker. The vulnerability's impact (I:H, C:N, A:N) is integrity-focused: administrators cannot be confident that their plugin configurations persist or were not silently altered by an attacker. The absence of technical difficulty (AC:L), combined with the criticality of the affected plugins (2FA, subscription, access control), means disabling these creates cascading security failures. EPSS score not provided, but the presence of proof-of-concept feasibility (trivial CSRF payload) and lack of user-visible indicators (silent plugin disabling) suggest exploitation probability is substantial. From an SSVC perspective: exploitation status is unconfirmed, but the attack is readily automatable; technical impact is high (plugin disabling breaks multiple security functions); this warrants immediate patching despite the moderate CVSS.

An attacker crafts a malicious webpage containing a hidden form or image tag that targets the pluginSwitch.json.php endpoint with parameters to disable the LoginControl plugin (2FA enforcement). When a logged-in AVideo administrator visits the attacker's page-perhaps via a phishing email or malicious advertisement-the admin's browser automatically submits the CSRF request using the admin's authenticated session cookie (transmitted due to SameSite=None). The endpoint receives the request, validates the active session, skips CSRF token verification, and disables 2FA. The admin is unaware until users report login anomalies or the security team discovers the disabled plugin during an audit. Publicly available exploit code has not been confirmed, but the attack is trivial to construct-a single HTML form submission in the context of an admin session is sufficient.