CVE-2026-86725: AVideo SocialMediaPublisher Auth Bypass

CVE-2026-86725 Overview

CVE-2026-86725 is a missing authorization vulnerability in the AVideo platform's SocialMediaPublisher plugin. The flaw affects the add.json.php endpoint through commit c3edcc274c389816d434acadac07ee78eaf330c1. Authenticated users can supply arbitrary row IDs to modify OAuth token records belonging to other accounts. Attackers can overwrite a victim's stored access_token and refresh_token, then delete the compromised record to sever the provider linkage. The weakness maps to [CWE-639], Authorization Bypass Through User-Controlled Key. This is a horizontal privilege escalation issue that impacts the integrity of stored OAuth credentials across tenants of the same AVideo instance.

Critical Impact
Any authenticated AVideo user can hijack or destroy another user's linked social media provider tokens by tampering with row IDs in add.json.php requests.

Affected Products

AVideo platform (WWBN/AVideo)
SocialMediaPublisher plugin
All builds up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1

Discovery Timeline

2026-09-08 - CVE-2026-86725 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86725

Vulnerability Analysis

The AVideo SocialMediaPublisher plugin exposes an add.json.php endpoint used to create and update OAuth token records for linked social media providers. The endpoint accepts a row identifier from the client and writes token data to the referenced record without verifying that the requesting user owns it. Any authenticated account can therefore address rows belonging to other users. Attackers can overwrite the target row's access_token and refresh_token fields with values they control, effectively substituting their own provider credentials into the victim's account context. Once the record has been overwritten, the same endpoint permits deletion, which destroys the victim's provider linkage and disrupts publishing workflows tied to that account.

Root Cause

The root cause is a missing authorization check on user-controlled object references [CWE-639]. The endpoint trusts the client-supplied row ID and does not enforce that the record's owning user matches the session's authenticated identity. The vendor advisory and VulnCheck writeup describe the flaw as an Insecure Direct Object Reference in the plugin's update path.

Attack Vector

Exploitation requires an authenticated but low-privileged AVideo account and network access to the application. The attacker submits an HTTP request to add.json.php referencing a row ID owned by another user and supplies attacker-controlled OAuth token values. A follow-on request can delete the same record. No user interaction from the victim is required. Refer to the GitHub Security Advisory and VulnCheck Advisory for full technical details.

No public proof-of-concept code has been verified for this CVE. The vulnerability mechanism is documented in prose only.

Detection Methods for CVE-2026-86725

Indicators of Compromise

Unexpected POST or GET requests to plugin/SocialMediaPublisher/add.json.php originating from low-privilege user sessions.
Sudden changes to access_token or refresh_token values in the SocialMediaPublisher token table without a corresponding user-initiated OAuth flow.
Deletion of SocialMediaPublisher token records shortly after an unusual update from a different user account.
Users reporting broken or missing social media provider linkages that were previously functional.

Detection Strategies

Correlate the authenticated user ID in AVideo session logs with the owner of the row ID referenced in each add.json.php request and alert on mismatches.
Instrument the plugin's database layer to log the acting user, the target row owner, and the fields modified on every write.
Baseline normal OAuth token rotation frequency per account and flag out-of-band token changes.

Monitoring Recommendations

Forward AVideo web server access logs and application logs to a centralized analytics platform for retention and query.
Monitor for repeated enumeration of sequential integer IDs against add.json.php and related plugin endpoints.
Alert on any HTTP 200 response to add.json.php where the request body contains a row ID not associated with the session user.

How to Mitigate CVE-2026-86725

Immediate Actions Required

Restrict access to the AVideo administrative interface and the SocialMediaPublisher plugin to trusted networks until a patched build is deployed.
Audit the plugin's token storage table for unauthorized modifications and rotate all stored OAuth credentials.
Revoke and re-issue provider-side OAuth grants for any account whose tokens may have been tampered with.
Disable the SocialMediaPublisher plugin if it is not required for production workflows.

Patch Information

A fix is tracked in the upstream GitHub Security Advisory GHSA-rp73-gjpj-w92v. Operators should upgrade AVideo to a build newer than commit c3edcc274c389816d434acadac07ee78eaf330c1 once the maintainers publish the fixed release. Verify that the patched add.json.php enforces ownership checks against the authenticated session identity before applying updates or deletes.

Workarounds

Remove or rename plugin/SocialMediaPublisher/add.json.php at the web server level to block access until patching is complete.
Add a reverse proxy rule that requires an administrator role to reach SocialMediaPublisher endpoints.
Apply an application-layer WAF rule that rejects requests to the endpoint when the submitted row ID does not match the session user.

bash

# Example NGINX rule to block the vulnerable endpoint until patched
location ~* /plugin/SocialMediaPublisher/add\.json\.php$ {
    deny all;
    return 403;
}