CVE-2026-58001: WWBN AVideo CSRF Vulnerability

CVE-2026-58001 Overview

CVE-2026-58001 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in WWBN AVideo, an open-source video streaming platform. The flaw affects the objects/videoEditLight.php endpoint through commit 9c39d8c8. The endpoint fails to validate request authenticity and accepts state-changing operations over HTTP GET requests. An attacker can embed an img tag inside a video description that silently transfers video ownership to an attacker-controlled account when an administrator views the video page.

Critical Impact
Administrators viewing an attacker-crafted video description automatically trigger a request that reassigns video ownership to an attacker-controlled account, resulting in loss of content integrity.

Affected Products

WWBN AVideo through commit 9c39d8c8
objects/videoEditLight.php endpoint
AVideo administrator and content management workflows

Discovery Timeline

2026-08-22 - CVE-2026-58001 published to the National Vulnerability Database (NVD)
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-58001

Vulnerability Analysis

The vulnerability resides in objects/videoEditLight.php, which processes video metadata updates without verifying request authenticity. The endpoint accepts HTTP GET requests for a sensitive state-changing action: transferring video ownership between user accounts. Because GET requests are automatically issued by browsers when rendering embedded resources, any HTML context that loads a URL can trigger the action.

An attacker with the ability to publish or edit a video description injects an img tag whose src attribute points to the vulnerable endpoint with parameters that reassign ownership. When an administrator opens the video page, the browser fetches the image URL, carrying the administrator's session cookies. The server accepts the request and executes the ownership change under the administrator's identity.

Root Cause

The root cause is the absence of anti-CSRF protections on objects/videoEditLight.php. The endpoint does not require a synchronizer token, does not validate a SameSite boundary, and does not restrict sensitive operations to POST with origin verification. Combined with stored HTML content in video descriptions, this creates a stored-CSRF condition.

Attack Vector

Exploitation requires low-privileged authenticated access to publish a video with a malicious description, and user interaction from a higher-privileged administrator who views the video. No credentials, tokens, or direct access to the administrator account are required. Technical details are documented in the GitHub Security Advisory GHSA-7mqw-mqc3-ffjw and the VulnCheck AVideo CSRF Advisory.

Detection Methods for CVE-2026-58001

Indicators of Compromise

Unexpected changes to the users_id or ownership field of video records in the AVideo database.
HTTP GET requests to objects/videoEditLight.php containing ownership-modification parameters and a Referer header pointing to a video watch page.
Video descriptions containing img tags whose src attributes reference internal administrative endpoints.

Detection Strategies

Inspect web server access logs for GET requests to /objects/videoEditLight.php that carry parameters altering ownership or user assignment.
Audit stored video descriptions for HTML tags referencing local URLs, especially img, iframe, and link elements pointing to objects/ paths.
Correlate administrator session activity with ownership changes to identify silent, unintended reassignments.

Monitoring Recommendations

Enable database-level auditing on the videos table to record all ownership field modifications with timestamps and initiating session.
Deploy a Web Application Firewall (WAF) rule that blocks GET requests to videoEditLight.php containing ownership parameters.
Alert on outbound requests generated from administrator sessions that target internal state-changing endpoints without a matching form submission.

How to Mitigate CVE-2026-58001

Immediate Actions Required

Upgrade AVideo to a version containing a commit later than 9c39d8c8 once the maintainers publish a fix, tracked in the GHSA-7mqw-mqc3-ffjw advisory.
Audit all existing video records for unauthorized ownership changes and restore correct ownership from backups where necessary.
Restrict administrator accounts from browsing user-submitted video pages until a patch is applied.

Patch Information

Refer to the GitHub Security Advisory GHSA-7mqw-mqc3-ffjw and the VulnCheck AVideo CSRF Advisory for current fix status. A mitigating change should require anti-CSRF tokens on objects/videoEditLight.php, reject GET for state-changing operations, and sanitize HTML in video descriptions.

Workarounds

Sanitize video descriptions server-side to strip img, iframe, and other tags that trigger automatic HTTP requests.
Configure session cookies with SameSite=Strict to prevent cross-site request delivery of authenticated cookies.
Add a WAF rule that requires a valid CSRF token header or blocks GET requests to objects/videoEditLight.php when ownership parameters are present.

bash

# Example WAF rule (ModSecurity) to block GET-based ownership changes
SecRule REQUEST_METHOD "@streq GET" \
  "chain,id:1026058001,phase:1,deny,status:403,log,msg:'CVE-2026-58001 AVideo CSRF block'"
  SecRule REQUEST_URI "@contains /objects/videoEditLight.php" \
    "chain"
    SecRule ARGS_NAMES "@rx (users_id|owner|user)" "t:lowercase"