WWBN AVideo EUVD-2026-68233

Exploitation requires that the victim be an authenticated AVideo administrator with an active, valid session cookie - standard user accounts are insufficient. The attacker must socially engineer this specific admin into visiting an attacker-controlled web page while logged in, after which the browser's automatic cookie inclusion completes the forged request. The site's outbound email functionality (sendEmail.json.php) must be operational and configured with valid SMTP credentials for the attack to produce delivered mail. Exploitation is limited to environments where the AVideo contact-email feature is enabled and reachable; deployments that have disabled or firewalled this endpoint are not affected.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N, score 5.3) accurately reflects a moderate-severity issue gated entirely on social engineering: the attacker needs no credentials of their own but must induce an authenticated admin to visit a malicious page. This user-interaction dependency (UI:P) substantially limits automated mass exploitation. No EPSS data was provided in the input; CISA KEV status is absent; no public proof-of-concept code has been identified at time of analysis. The score is appropriate - this is not a high-urgency patch-now issue for most operators, but the email authentication bypass (SPF/DKIM/DMARC pass-through) elevates real-world harm beyond a typical low-impact CSRF, specifically for operators concerned with domain reputation and phishing abuse. No CVSS scoring conflicts or inconsistencies were identified in the provided data.

An attacker crafts a hidden HTML form on a malicious web page targeting sendEmail.json.php with attacker-chosen subject, body text, and recipient email addresses. When an AVideo administrator visits the page while holding an active authenticated session, the browser silently submits the forged POST request; the server processes it, bypassing origin and captcha checks, and sends the email from the platform's configured contact address. Recipients receive a message bearing the site's domain with full SPF/DKIM/DMARC authentication, making it suitable for credential phishing or brand impersonation campaigns.