CVE-2026-83595: AVideo CSRF Vulnerability in API Endpoint

CVE-2026-83595 Overview

CVE-2026-83595 is a Cross-Site Request Forgery (CSRF) vulnerability in AVideo, an open-source video platform maintained by WWBN. The flaw resides in plugin/API/set.json.php, which processes state-changing operations through GET requests without adequate CSRF protection. An attacker can craft a malicious URL that triggers privileged API actions when an authenticated victim visits it. Successful exploitation allows adversaries to delete videos, deactivate user accounts, or modify playlists without the victim's consent. The weakness is tracked under CWE-352: Cross-Site Request Forgery.

Critical Impact
A single user interaction with an attacker-controlled link can cause destructive changes to AVideo content and account state, including video deletion and account deactivation.

Affected Products

AVideo (WWBN) — plugin/API/set.json.php endpoint
AVideo deployments exposing the plugin API to authenticated users
Refer to the GitHub Security Advisory GHSA-mwr9-5m78-rhgm for version specifics

Discovery Timeline

2026-09-01 - CVE-2026-83595 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-83595

Vulnerability Analysis

The vulnerability affects the plugin/API/set.json.php endpoint in AVideo. This endpoint accepts state-changing operations through HTTP GET requests and lacks anti-CSRF tokens or origin validation. An authenticated user's session cookies are automatically attached when their browser follows a crafted link, enabling the attacker to perform actions under the victim's identity. The requests do not require any prior compromise of credentials.

Because the endpoint drives administrative and content operations, exploitation yields high integrity and availability impact on AVideo data. Confidentiality of stored data is not directly affected, but destructive actions such as video removal and account deactivation are within scope. Additional detail is documented in the Vulncheck CSRF Advisory.

Root Cause

The root cause is missing CSRF protection on a sensitive API surface. The endpoint accepts side-effecting operations via GET without validating a synchronizer token, SameSite cookie posture, or the Origin and Referer headers. Any request originating from an attacker-controlled page inherits the victim's authenticated session.

Attack Vector

An attacker hosts a page containing an image tag, form, or script that references the AVideo API with target parameters. When a logged-in victim visits the page, the browser issues the GET request to AVideo carrying session cookies. AVideo executes the operation as if the victim initiated it. Typical payload actions include deleting a specific video ID, deactivating the user account, or altering playlist membership.

No verified exploit code has been published. See the GitHub Security Advisory for a technical description of the vulnerable request pattern.

Detection Methods for CVE-2026-83595

Indicators of Compromise

Unexpected DELETE, deactivate, or playlist-modification actions attributed to legitimate user sessions in AVideo application logs
Web server access logs showing GET requests to plugin/API/set.json.php with a Referer header pointing to an external, untrusted origin
User reports of missing videos, disabled accounts, or altered playlists without corresponding admin actions

Detection Strategies

Inspect AVideo access logs for calls to plugin/API/set.json.php where the Referer or Origin header does not match the AVideo host
Correlate content deletion and account state changes with the source IP and User-Agent of the originating request to identify anomalous patterns
Alert on state-changing API calls that arrive without a valid CSRF token parameter once mitigations are enforced

Monitoring Recommendations

Enable verbose logging on the AVideo web tier and forward events to a centralized SIEM for retention and correlation
Baseline normal rates of video deletion and account deactivation, and trigger alerts on statistical deviations
Monitor outbound links shared via email, chat, and forums for URLs pointing at the AVideo API endpoint

How to Mitigate CVE-2026-83595

Immediate Actions Required

Upgrade AVideo to the fixed release identified in the GitHub Security Advisory GHSA-mwr9-5m78-rhgm
Restrict access to plugin/API/set.json.php at the web server or reverse proxy layer until the patch is deployed
Invalidate existing sessions and require re-authentication for administrative users

Patch Information

The AVideo maintainers have issued a security advisory tracking this vulnerability. Consult the GitHub Security Advisory and the Vulncheck CSRF Advisory for the fixed version identifiers and upgrade instructions.

Workarounds

Configure session cookies with SameSite=Strict or SameSite=Lax to block cross-site cookie transmission on state-changing GET requests
Deploy a Web Application Firewall (WAF) rule that blocks requests to plugin/API/set.json.php when Referer or Origin headers are absent or point to unknown domains
Instruct administrators to log out of AVideo when browsing untrusted sites and to use a dedicated browser profile for administrative work

bash

# Example nginx configuration to restrict the vulnerable endpoint by Referer
location = /plugin/API/set.json.php {
    valid_referers server_names;
    if ($invalid_referer) {
        return 403;
    }
    proxy_pass http://avideo_backend;
}