CVE-2026-92581: AVideo Vote Manipulation Vulnerability

CVE-2026-92581 Overview

CVE-2026-92581 affects AVideo through version 29.0, an open-source video streaming platform maintained by WWBN. The vulnerability resides in the Like::__construct() method, which performs counter arithmetic on raw request values before validating their type. Authenticated attackers can submit array-typed like parameters that desynchronize stored votes from the denormalized like counter. Subsequent ordinary requests drive video like counts arbitrarily negative, and the corruption persists until manual database repair. The issue is classified under CWE-20: Improper Input Validation.

Critical Impact
Authenticated attackers can corrupt persistent like counters on AVideo instances, producing negative values that survive across sessions and require manual intervention to restore.

Affected Products

AVideo (WWBN) through version 29.0
AVideo instances exposing the Like endpoint to authenticated users
Deployments relying on denormalized like counters for video ranking or display

Discovery Timeline

2026-09-16 - CVE-2026-92581 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92581

Vulnerability Analysis

The flaw exists in AVideo's Like::__construct() method, which processes incoming vote requests. The constructor performs arithmetic on request parameters without first validating that the values are scalar. When an attacker submits a like parameter as an array, PHP's type coercion produces unexpected behavior during counter arithmetic while the underlying vote row is not consistently stored. The result is a desynchronization between the actual vote records and the denormalized counter column used for display and ranking.

Once the state is desynchronized, subsequent legitimate like or dislike requests operate against a corrupted baseline. Repeated requests can drive the counter arbitrarily negative. Because the counter is denormalized, the corruption persists across sessions and application restarts. Restoration requires manual recomputation from the source vote table.

Root Cause

The root cause is improper input validation ([CWE-20]). The Like::__construct() method treats raw request input as trusted scalar data before applying type checks. PHP accepts array-typed query and body parameters natively, and without an explicit is_scalar() or type-cast gate, the arithmetic path executes against unexpected structures. This violates the principle of validating input at the trust boundary.

Attack Vector

Exploitation requires an authenticated account on the target AVideo instance. The attacker sends a crafted HTTP request containing an array-typed like parameter, for example using the like[]=1 query syntax that PHP interprets as an array. This poisons the counter state. The attacker then issues ordinary like or dislike requests, each of which further shifts the counter into negative territory. No elevated privileges are required beyond a standard authenticated session.

Refer to the GitHub Security Advisory GHSA-hcfp-7hrc-5rvg and the VulnCheck Advisory on AVideo for the upstream technical write-up.

Detection Methods for CVE-2026-92581

Indicators of Compromise

Video records where the denormalized like counter value is negative or diverges from the count of associated rows in the votes table.
HTTP access logs containing like[]= or bracket-encoded array parameters directed at AVideo like endpoints.
Sudden large deltas in like counters for individual videos not correlated with traffic volume.

Detection Strategies

Compare the denormalized like counter against a COUNT(*) aggregation from the underlying votes table on a scheduled basis and alert on drift.
Add web application firewall rules that reject requests where the like parameter is submitted as an array type.
Instrument the Like::__construct() code path to log parameter types received in production for audit review.

Monitoring Recommendations

Monitor authenticated user sessions that generate anomalously high rates of like or dislike requests against distinct videos.
Track application error logs for PHP type warnings originating from the Like class during counter arithmetic.
Review database change logs for repeated decrements to like counter columns without corresponding vote row insertions.

How to Mitigate CVE-2026-92581

Immediate Actions Required

Upgrade AVideo to a version later than 29.0 once WWBN publishes a patched release addressing GHSA-hcfp-7hrc-5rvg.
Restrict the like endpoint to authenticated sessions with rate limiting until the patch is deployed.
Run a reconciliation script that recomputes like counters from the votes table and repairs any negative values already stored.

Patch Information

A fix is coordinated through the WWBN AVideo project. Track the GitHub Security Advisory GHSA-hcfp-7hrc-5rvg for release status. Apply the vendor-supplied update as soon as it becomes available, then run the reconciliation routine to restore any corrupted counters.

Workarounds

Deploy a reverse proxy or WAF rule that rejects requests containing array-typed like parameters, for example any query string matching like[.
Patch Like::__construct() locally to call is_scalar() on the incoming parameter and reject non-scalar inputs before arithmetic executes.
Schedule a recurring database job that recomputes denormalized like counters from vote rows to bound the duration of any undetected corruption.

bash

# Example NGINX rule to block array-typed like parameters
if ($args ~* "(^|&)like(\[|%5B)") {
    return 400;
}