CVE-2026-92579 Overview
CVE-2026-92579 is a broken access control vulnerability affecting AVideo through version 29.0. The autoCSRFGuard() function maintains a hardcoded allowlist of exempt basenames that is tested without directory context. This design flaw allows plugin files matching core filenames to inherit Cross-Site Request Forgery (CSRF) exemptions unintentionally. The LoginWordPress plugin file login.json.php inherits an exemption and unconditionally logs out authenticated users on cross-site POST requests before validating credentials. The issue is classified under [CWE-289: Authentication Bypass by Alternate Name].
Critical Impact
Attackers can forcibly log out authenticated AVideo users through a cross-site POST request, disrupting user sessions without any authentication.
Affected Products
- AVideo platform through version 29.0
- AVideo LoginWordPress plugin (login.json.php)
- Deployments relying on autoCSRFGuard() for request validation
Discovery Timeline
- 2026-09-16 - CVE-2026-92579 published to the National Vulnerability Database (NVD)
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-92579
Vulnerability Analysis
The vulnerability stems from an unsafe pattern in how AVideo enforces CSRF protection. The autoCSRFGuard() function maintains an allowlist of filenames that are exempt from CSRF validation. This allowlist is evaluated using only the file basename and ignores the parent directory path. Any plugin file whose name matches a core-exempt filename inherits the exemption regardless of its location or purpose.
The LoginWordPress plugin ships with login.json.php, which collides with a core-exempt basename. As a result, the plugin endpoint is treated as CSRF-exempt and processes cross-origin POST requests without token validation. The endpoint executes a logout action before any credential validation, so an attacker only needs to trigger a POST from an attacker-controlled page to terminate an authenticated user's session.
Root Cause
The root cause is a basename collision in an authentication allowlist [CWE-289]. Comparing file identity using basename alone, without qualifying the directory, breaks the security assumption that only vetted core endpoints receive the CSRF exemption.
Attack Vector
Exploitation requires an authenticated victim to load or interact with an attacker-controlled page that issues a cross-site POST request to the vulnerable login.json.php endpoint. Because the exempt endpoint executes the logout logic prior to credential checks, the victim's session is terminated. No credentials, tokens, or elevated privileges are required from the attacker. The impact is limited to session integrity and availability rather than data confidentiality.
No verified proof-of-concept code is publicly available. Refer to the GitHub Security Advisory GHSA-3hg6-6x7m-5xr8 and the VulnCheck Advisory on AVideo for further technical detail.
Detection Methods for CVE-2026-92579
Indicators of Compromise
- Unexpected POST requests to /plugin/LoginWordPress/login.json.php originating from external Referer or Origin headers.
- Clusters of session termination events for authenticated users without matching logout activity in application logs.
- User complaints about being repeatedly signed out during normal browsing sessions.
Detection Strategies
- Inspect web server access logs for cross-origin POST requests targeting AVideo plugin endpoints that share basenames with core files.
- Correlate application session termination events with the presence of external Referer headers or missing CSRF tokens.
- Audit the AVideo plugin directory for files whose basenames overlap with the autoCSRFGuard() allowlist entries.
Monitoring Recommendations
- Enable verbose HTTP request logging for all /plugin/ paths in the AVideo deployment.
- Alert on spikes in logout events per unit time, particularly those lacking a corresponding authenticated user action.
- Monitor egress web application firewall (WAF) telemetry for POST requests to AVideo endpoints missing anti-CSRF tokens.
How to Mitigate CVE-2026-92579
Immediate Actions Required
- Upgrade AVideo to a version later than 29.0 that addresses the basename collision in autoCSRFGuard().
- Disable or remove the LoginWordPress plugin if a patched version is not yet available.
- Restrict access to plugin endpoints through WAF rules that enforce same-origin Origin and Referer validation for POST requests.
Patch Information
Refer to the GitHub Security Advisory GHSA-3hg6-6x7m-5xr8 for upstream remediation guidance from the WWBN/AVideo maintainers. The fix requires evaluating CSRF exemptions using full path context rather than basename alone, and revalidating the plugin endpoint to require CSRF tokens before executing any state-changing logout logic.
Workarounds
- Deploy a WAF rule that blocks POST requests to /plugin/LoginWordPress/login.json.php when the Origin header does not match the AVideo hostname.
- Rename or relocate colliding plugin files so their basenames no longer match entries in the CSRF exemption allowlist.
- Enforce SameSite=Strict cookies on AVideo session cookies to reduce cross-site POST exposure.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
