CVE-2026-86724: AVideo YPTWallet CSRF Vulnerability

CVE-2026-86724 Overview

CVE-2026-86724 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in AVideo, an open-source video streaming platform. The flaw resides in the plugin/YPTWallet/view/saveBalance.php endpoint, which relies solely on session cookies for authentication and does not validate anti-CSRF tokens. An attacker can craft a malicious webpage that, when loaded by an authenticated administrator, silently issues a POST request to modify any user's wallet balance to an arbitrary value. The issue affects AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1.

Critical Impact
A single administrator visit to an attacker-controlled page can alter any user's wallet balance, enabling financial fraud and integrity loss within the YPTWallet plugin.

Affected Products

AVideo (WWBN) through commit c3edcc274c389816d434acadac07ee78eaf330c1
AVideo YPTWallet plugin (plugin/YPTWallet/view/saveBalance.php)
Installations exposing the administrator interface to browsers with active sessions

Discovery Timeline

2026-09-08 - CVE-2026-86724 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-86724

Vulnerability Analysis

The vulnerability exists because saveBalance.php in the YPTWallet plugin authenticates state-changing requests using only the PHP session cookie. The endpoint accepts POST parameters that specify a target user identifier and a new wallet balance. Because browsers automatically attach cookies to cross-origin requests, an attacker can trigger the endpoint from any external site the administrator visits.

The endpoint performs no origin validation, no Referer verification, and no synchronizer or double-submit CSRF token check. As a result, any authenticated administrator session becomes an implicit authorization for arbitrary balance modifications. Successful exploitation impacts the integrity of financial records maintained by the wallet plugin.

Root Cause

The root cause is missing CSRF protection on a privileged, state-changing endpoint. The application does not bind the request to a per-session, unpredictable token that the attacker cannot forge from a cross-origin context. This is a canonical CWE-352 pattern in which server-side session trust is conflated with intent verification.

Attack Vector

Exploitation requires an authenticated administrator to load attacker-controlled content while their AVideo session is active. The attacker hosts a page containing an auto-submitting HTML form or a scripted fetch call targeting the saveBalance.php endpoint with the desired user identifier and balance value. The request executes with the administrator's privileges, and the server updates the wallet balance without further checks. No credentials, tokens, or additional user prompts are needed beyond the initial page load.

For endpoint-level technical detail, refer to the GitHub Security Advisory GHSA-v2q3-cpm3-r8pq and the VulnCheck Advisory for AVideo.

Detection Methods for CVE-2026-86724

Indicators of Compromise

Unexpected POST requests to /plugin/YPTWallet/view/saveBalance.php originating from administrator sessions with an external Referer header.
Wallet balance modifications in audit logs that do not correspond to any legitimate administrative workflow.
Sudden balance changes for multiple user accounts within a short time window.

Detection Strategies

Inspect web server access logs for POST requests to saveBalance.php where the Referer or Origin header is missing or points to an untrusted domain.
Correlate administrator authentication events with wallet-modification events to detect activity that occurs outside of expected admin console navigation.
Deploy web application firewall rules that flag or block cross-origin POST requests to the YPTWallet endpoint.

Monitoring Recommendations

Enable verbose logging on the YPTWallet plugin to capture the actor, target user, prior balance, and new balance for every modification.
Alert on balance changes exceeding a defined threshold or occurring outside business hours.
Monitor administrator browser sessions for concurrent access to external, non-corporate web content.

How to Mitigate CVE-2026-86724

Immediate Actions Required

Disable the YPTWallet plugin until a patched build is deployed if wallet functionality is not business-critical.
Restrict administrative access to the AVideo backend using network-level controls such as IP allowlisting or VPN gating.
Instruct administrators to use a dedicated browser profile for AVideo management and to log out immediately after use.

Patch Information

No fixed release is identified in the enriched CVE data. Track the upstream fix through the WWBN AVideo GitHub repository and the GitHub Security Advisory GHSA-v2q3-cpm3-r8pq for the commit that introduces CSRF token validation on saveBalance.php.

Workarounds

Add a reverse-proxy rule that rejects requests to /plugin/YPTWallet/view/saveBalance.php when the Origin or Referer header does not match the trusted AVideo hostname.
Configure session cookies with SameSite=Strict to prevent cross-site POST submissions from carrying administrator authentication.
Enforce reauthentication or a step-up confirmation prompt in front of any wallet balance modification workflow.

bash

# Example nginx snippet: block cross-origin POSTs to the vulnerable endpoint
location = /plugin/YPTWallet/view/saveBalance.php {
    if ($request_method = POST) {
        set $csrf_block "1";
    }
    if ($http_origin !~* "^https://avideo\.example\.com$") {
        set $csrf_block "${csrf_block}1";
    }
    if ($csrf_block = "11") {
        return 403;
    }
    include fastcgi_params;
    fastcgi_pass php-fpm;
}