CVE-2026-89148: AVideo CSRF and Open Redirect Vulnerability

CVE-2026-89148 Overview

CVE-2026-89148 is an open redirect vulnerability in the WWBN AVideo platform, affecting builds through commit c3edcc274c389816d434acadac07ee78eaf330c1. The flaw resides in objects/playlistSort.php, which sets a Location header to an unvalidated HTTP_REFERER value. Because the endpoint is not a *.json.php script, the framework's automatic Cross-Site Request Forgery (CSRF) guard, autoCSRFGuard()/forbidIfIsUntrustedRequest(), does not run. A remote unauthenticated attacker can chain the missing CSRF check with the unsafe redirect to reorder a victim's playlist and send the victim's browser to an attacker-controlled site. No patched version is available at the time of publication.

Critical Impact
Attackers can silently reorder a logged-in user's playlist and redirect the victim from a trusted AVideo domain to an attacker-controlled phishing page.

Affected Products

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1
The vulnerable script objects/playlistSort.php
Any AVideo deployment where users hold playlist management permissions

Discovery Timeline

2026-09-11 - CVE-2026-89148 published to the National Vulnerability Database (NVD)
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-89148

Vulnerability Analysis

The issue combines two weaknesses in objects/playlistSort.php. First, AVideo's CSRF protection is applied automatically only to endpoints matching the *.json.php naming convention. Because playlistSort.php does not match that pattern, autoCSRFGuard() and forbidIfIsUntrustedRequest() never execute for this endpoint. Second, when the request includes the sort parameter, the script issues an HTTP Location response header populated from $_SERVER['HTTP_REFERER'] without passing the value through isSafeRedirectURL().

The combined behavior lets an attacker forge a cross-origin POST from a page under their control. The victim's browser sends the request with a Referer set to the attacker's domain, AVideo reorders the playlist, and the response redirects the browser off-site. The vulnerability is tracked under CWE-352: Cross-Site Request Forgery.

Root Cause

The root cause is missing input validation on HTTP_REFERER combined with an implicit trust boundary in AVideo's CSRF framework. The framework assumes only JSON endpoints require CSRF enforcement, leaving non-JSON scripts such as playlistSort.php unprotected. Redirect destinations should always be validated through isSafeRedirectURL() before being written into a Location header.

Attack Vector

Exploitation requires a victim who is authenticated to AVideo and holds permission to sort the targeted playlist. The attacker hosts a page that auto-submits a cross-origin POST to objects/playlistSort.php with the sort parameter. The victim's browser attaches session cookies and a Referer pointing to the attacker's page. AVideo processes the reorder and returns a redirect to that attacker-controlled URL, enabling phishing that appears to originate from a trusted AVideo domain.

No verified exploit code is public. See the GitHub Security Advisory GHSA-jj4v-c999-cm2m and the VulnCheck Advisory on AVideo for additional technical detail.

Detection Methods for CVE-2026-89148

Indicators of Compromise

POST requests to /objects/playlistSort.php containing a sort parameter and a Referer header pointing to an external domain
HTTP 302 responses from playlistSort.php with Location headers pointing to non-AVideo hosts
Unexplained changes to playlist ordering that correlate in time with cross-origin request activity

Detection Strategies

Inspect web server access logs for POSTs to objects/playlistSort.php where the Referer header does not match the AVideo application's own origin.
Alert on outbound Location headers from AVideo responses whose host component is not on an allowlist of trusted domains.
Correlate playlist reorder audit events with the originating Referer to surface abnormal cross-site submissions.

Monitoring Recommendations

Enable verbose HTTP request logging on the AVideo web server to capture full Referer values.
Forward web and application logs into a centralized analytics platform for retention and anomaly detection.
Track user reports of unexpected redirects from AVideo URLs as a leading indicator of active abuse.

How to Mitigate CVE-2026-89148

Immediate Actions Required

Restrict access to objects/playlistSort.php at the reverse proxy or Web Application Firewall (WAF) layer until a vendor fix is available.
Enforce a strict Referer policy on POSTs to playlistSort.php, rejecting requests whose Referer does not match the application origin.
Reduce the number of accounts holding playlist management permissions to shrink the exploitable population.

Patch Information

No patched version of AVideo is available. Monitor the WWBN AVideo GitHub Security Advisory GHSA-jj4v-c999-cm2m for updates and apply the vendor patch immediately once released.

Workarounds

Add a WAF rule that blocks POST requests to /objects/playlistSort.php when the Referer header host does not equal the AVideo canonical hostname.
Deploy a reverse-proxy filter that strips or rewrites any outbound Location header from playlistSort.php pointing to non-AVideo domains.
If a local patch is feasible, wrap the redirect logic in playlistSort.php with an isSafeRedirectURL() check and invoke forbidIfIsUntrustedRequest() at the top of the script.

bash

# Example ModSecurity rule to block cross-origin POSTs to the vulnerable endpoint
SecRule REQUEST_METHOD "@streq POST" \
  "chain,id:2026089148,phase:1,deny,status:403,msg:'CVE-2026-89148 AVideo playlistSort CSRF/open redirect'"
  SecRule REQUEST_URI "@streq /objects/playlistSort.php" \
    "chain"
    SecRule REQUEST_HEADERS:Referer "!@beginsWith https://avideo.example.com/"