CVE-2026-89245: WWBN AVideo CSRF Vulnerability

CVE-2026-89245 Overview

CVE-2026-89245 is a cross-site request forgery (CSRF) vulnerability in WWBN AVideo, an open-source video streaming platform. The flaw exists in playlistRemove.php through commit c3edcc274c389816d434acadac07ee78eaf330c1 and stems from missing CSRF protection checks. An attacker can craft a malicious page that submits a POST request to playlistRemove.php. When an authenticated user visits the page, their playlist is deleted without their consent. The vulnerability is categorized under CWE-352: Cross-Site Request Forgery.

Critical Impact
Authenticated users visiting an attacker-controlled page can have their playlists silently deleted, resulting in loss of user-generated content organization.

Affected Products

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1
AVideo streaming platform deployments using the playlistRemove.php endpoint
Self-hosted AVideo instances that rely on session-based authentication

Discovery Timeline

2026-09-11 - CVE-2026-89245 published to the National Vulnerability Database (NVD)
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-89245

Vulnerability Analysis

The vulnerability resides in the playlistRemove.php endpoint of WWBN AVideo. The endpoint accepts POST requests to delete a user's playlist but does not validate a CSRF token or verify the request origin. Any browser session with an active AVideo login cookie will automatically attach that cookie to a cross-origin POST request initiated by an attacker.

An attacker who can lure an authenticated victim to a malicious page can trigger playlist deletion without any explicit action beyond page interaction. Successful exploitation requires user interaction, such as clicking a link or loading a page containing the attacker's crafted form. Impact is limited to integrity of the playlist data; confidentiality and availability of the wider system are not directly affected.

Root Cause

The root cause is the absence of a synchronizer token, double-submit cookie, or SameSite enforcement on the state-changing playlistRemove.php handler. The endpoint trusts the authenticated session cookie alone to authorize deletion, which is the core anti-pattern described by CWE-352.

Attack Vector

Exploitation is remote and network-based. An attacker hosts a web page containing an HTML form that targets the victim's AVideo instance at /playlistRemove.php, with hidden input fields identifying the playlist to remove. The form is submitted automatically via JavaScript, or the victim is enticed to click a button. Because the victim's browser attaches the AVideo session cookie to the cross-origin POST, the server processes the deletion as if the user initiated it.

For implementation details, refer to the GitHub Security Advisory GHSA-v7mf-qx22-m9x8 and the VulnCheck CSRF Advisory.

Detection Methods for CVE-2026-89245

Indicators of Compromise

Unexpected POST requests to /playlistRemove.php with Referer or Origin headers pointing to third-party domains.
Playlist deletion events in application logs that do not correlate with a preceding user action on the AVideo UI.
Clusters of playlist deletions across multiple accounts within a short time window, suggesting mass exploitation.

Detection Strategies

Inspect web server access logs for POST requests to playlistRemove.php where the Origin header does not match the AVideo host.
Correlate playlist deletion audit events against expected referrer paths within the AVideo application.
Deploy a web application firewall (WAF) rule that flags state-changing requests missing a valid CSRF token.

Monitoring Recommendations

Enable and centralize AVideo application logs, including full HTTP headers for state-changing endpoints.
Alert on anomalous spikes in playlist-removal API calls per user or per source IP.
Monitor user support channels for reports of unexpected playlist loss, which may indicate active exploitation.

How to Mitigate CVE-2026-89245

Immediate Actions Required

Update WWBN AVideo to a build later than commit c3edcc274c389816d434acadac07ee78eaf330c1 that includes the CSRF fix.
Set session cookies to SameSite=Lax or SameSite=Strict to block cross-origin POST submissions.
Restrict access to administrative and playlist-management endpoints to trusted networks where feasible.

Patch Information

Refer to the WWBN AVideo GitHub Security Advisory GHSA-v7mf-qx22-m9x8 for patched commit information and upgrade guidance. Administrators should pull the latest upstream commit and redeploy after verification in a staging environment.

Workarounds

Deploy a WAF rule requiring a valid CSRF token header on all POST requests to playlistRemove.php.
Enforce SameSite=Strict on the AVideo session cookie at the reverse proxy layer until patching is complete.
Educate users to log out of AVideo when browsing untrusted sites to reduce the window of exploitability.

bash

# Example nginx configuration to enforce SameSite and validate Origin
location = /playlistRemove.php {
    if ($http_origin !~* ^https://avideo\.example\.com$) {
        return 403;
    }
    proxy_cookie_flags ~ SameSite=Strict Secure HttpOnly;
    proxy_pass http://avideo_backend;
}