WWBN AVideo EUVD-2026-64262

The attacker must possess a registered user account on the target AVideo instance with sufficient privileges to submit or edit video descriptions containing arbitrary HTML (PR:L). An administrator with an active authenticated session must subsequently view the page containing the malicious video description (UI:P - passive viewing is sufficient; no explicit click or form submission by the admin is required). The target AVideo deployment must be running a version at or before commit 9c39d8c8. Exploitation is limited by: the requirement for a low-privilege account (no anonymous exploitation path); the dependency on administrator page-view timing; and the impact being scoped to video ownership transfer within the application rather than system-level compromise. Non-default configurations that strip img tags from user-submitted content or enforce strict CSP would neutralize the delivery mechanism.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N) captures the key risk dynamics accurately: the attack is network-delivered, low complexity, but requires two preconditions - a low-privilege attacker account (PR:L) and passive administrator interaction (UI:P). The integrity impact is rated high (VI:H) because ownership transfer is a meaningful privilege escalation within the application, potentially allowing exfiltration or modification of content the attacker would not otherwise control. No EPSS score was provided in the source data, and the vulnerability is not listed in CISA KEV, so exploitation appears opportunistic or targeted rather than widespread. The real-world risk is moderate for AVideo deployments where untrusted users can post video content viewed by administrators - a common community video platform scenario. The limiting factors (low-privilege account requirement and admin user-interaction) meaningfully reduce the blast radius compared to a fully unauthenticated CSRF. No EPSS data available for quantitative comparison.

An attacker registers a low-privilege account on a public-facing AVideo instance, uploads a video, and embeds a crafted img tag (e.g., pointing to videoEditLight.php with ownership-transfer parameters and their own user ID as the new owner) in the video's description field. When an administrator navigates to review or manage that video, the administrator's browser automatically issues the GET request with the admin's active session cookie, transferring ownership of a target video to the attacker's account without any visible indication. No public exploit code was identified in the referenced sources, but the attack is mechanically trivial given the self-contained description.