Avideo EUVD-2026-17658

The CVSS 6.1 score reflects moderate severity with network-based attack vector, low complexity, and no privilege requirements-the CVSS vector PR:N indicates the initial request requires no authentication. However, the practical attack chain requires user interaction (UI:R) and relies on social engineering to trick an admin into clicking a malicious link. Real-world risk is elevated by three factors: (1) the SameSite=None configuration explicitly bypasses modern XSS defenses intended for cross-origin requests, indicating either misconfiguration or intentional loosening of security posture; (2) admin accounts typically control critical platform functions, amplifying impact if compromised; (3) the scope change (S:C) means the vulnerability can affect resources beyond the vulnerable component. However, no EPSS percentile, active KEV status, or public exploit code is documented, suggesting either limited visibility in exploitation databases or genuine lack of weaponization to date. This is a real priority for AVideo operators, particularly those with SameSite=None in production, but lower urgency than actively exploited vulnerabilities.

An attacker crafts a URL to the vulnerable testIP.php endpoint with JavaScript payload in the ip parameter, e.g., testIP.php?ip=<script>fetch('/admin/steal-api-key')</script>. The attacker hosts this link on a separate domain and tricks an AVideo admin into clicking it via phishing email or forum post. Because AVideo's session cookie is set with SameSite=None, the browser includes the admin's authenticated session cookie in the cross-origin request. The reflected XSS payload executes in the admin's browser context, allowing the attacker to exfiltrate API credentials, modify user accounts, or upload malicious content. The attack requires user interaction (clicking the link) but no special network position or authentication on the attacker's part.