WWBN AVideo EUVD-2026-75422

Exploitation requires an authenticated AVideo administrator to visit an attacker-controlled webpage while an active session to the target AVideo instance exists in the same browser. The setPassword.json.php endpoint must be network-reachable from the victim's browser (AV:N), and the instance must be running AVideo at or before commit c3edcc274c389816d434acadac07ee78eaf330c1. No special server configuration, non-default feature, or elevated attacker privileges are required - the vulnerable endpoint is present in default AVideo installations. Exploitation is limited by the UI:P requirement: the attacker cannot trigger the state change without the admin visiting the malicious page, making phishing or social engineering a necessary precursor.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:N) accurately characterizes the attack: the attacker needs no credentials, no special configuration, and no complexity to craft the payload, but the attack is gated entirely on passive user interaction from an authenticated administrator. The high integrity signal (VI:H) reflects that any user's channel password - including those of other administrators - can be silently set to an attacker-chosen value or cleared, enabling account takeover across the platform. The low confidentiality component (VC:L) is secondary, likely reflecting that response state from the endpoint may reveal account existence. No EPSS data was provided and there is no CISA KEV listing, so exploitation probability from threat-intelligence sources cannot be quantified; however, phishing administrators is a commonplace technique, meaning the UI:P prerequisite is not a strong barrier in practice - even a mid-sized community media operator in olsztyn running AVideo should treat this as urgent remediation given the high frequency of admin-targeted phishing campaigns. No active exploitation has been confirmed from available data.

An attacker discovers an AVideo deployment and obtains an administrator's email address, then sends a phishing message linking to an attacker-controlled page containing an HTML img tag with its src set to the target instance's /setPassword.json.php with a chosen password parameter. When the administrator's browser loads the page while logged in, the browser silently fires the GET request with the admin's session cookie, changing the targeted user's channel password to the attacker's value - no public exploit code is known, but the attack requires only basic HTML knowledge.