CVE-2026-92582: AVideo CSRF Vulnerability

CVE-2026-92582 Overview

CVE-2026-92582 is a cross-site request forgery (CSRF) vulnerability in AVideo (WWBN/AVideo) through version 29.0 (commit e01e41ecc). The flaw resides in objects/videoAddNew.json.php, which disables the automatic CSRF guard and the untrusted-request check when user and pass parameters are present in the request. The credentials are never validated, allowing attackers to bypass CSRF protection using session cookies from authenticated victims. Successful exploitation allows unauthorized modification of video records, including ownership transfer, access restriction removal, and metadata tampering. No patched version was available at the time of the advisory.

Critical Impact
An attacker who lures an authenticated AVideo user with upload rights to a crafted page can hijack video records, transfer ownership, and strip access restrictions from private content across the platform.

Affected Products

WWBN AVideo through version 29.0
AVideo commit e01e41ecc and prior
Any AVideo deployment exposing objects/videoAddNew.json.php

Discovery Timeline

2026-09-16 - CVE-2026-92582 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92582

Vulnerability Analysis

The vulnerability [CWE-352] resides in AVideo's objects/videoAddNew.json.php endpoint. The script sets both $global['skipAutoCSRFCheck'] and $global['bypassSameDomainCheck'] when it detects user and pass parameters in the incoming request. This behavior appears intended to support programmatic API access using HTTP basic credentials, but the implementation never validates the supplied values.

Because User::loginFromRequestIfNotLogged() returns immediately when a session already exists, a victim authenticated via cookie satisfies the authentication check while the attacker-supplied credentials are discarded. The endpoint's protections are effectively unlocked by the mere presence of the parameters.

Root Cause

The root cause is a conditional bypass of CSRF and same-origin checks based on the presence of user-controlled request parameters rather than the successful authentication of those parameters. Values are read from $_REQUEST, so attackers can supply them via the query string of a cross-site request without any prior authentication.

Attack Vector

An attacker crafts a malicious page that issues a cross-origin request to objects/videoAddNew.json.php with user and pass parameters in the query string. When an authenticated AVideo user visits the page, the browser attaches session cookies, satisfying the session check while the CSRF guard remains disabled.

The request can modify fields including setUsers_id (ownership transfer), user-group access restrictions, can_download, can_share, only_for_paid, video_password, rating, status, creation date, and view count. Victims with administrator privileges or Permissions::canAdminVideos() rights extend the attack surface to every video on the site, including removing group restrictions from private content.

See the GitHub Security Advisory GHSA-qf9p-jhx7-rhmf and the VulnCheck Access Control Advisory for additional technical detail.

Detection Methods for CVE-2026-92582

Indicators of Compromise

Cross-origin POST or GET requests to objects/videoAddNew.json.php containing user and pass query parameters
Unexpected changes to video ownership (setUsers_id), video_password, status, or can_share fields in the AVideo database
Private videos with user-group access restrictions silently removed
HTTP Referer or Origin headers pointing to external domains for requests reaching videoAddNew.json.php

Detection Strategies

Inspect web server access logs for requests to videoAddNew.json.php that include user= and pass= in the query string
Correlate video record modifications with the source IP and referrer of the initiating HTTP request
Alert on administrator-account requests to videoAddNew.json.php originating from non-application referrers

Monitoring Recommendations

Enable database audit logging for the videos table to capture unauthorized ownership, permission, and metadata changes
Forward AVideo web server logs to a centralized analytics or SIEM platform for anomaly detection
Monitor for spikes in cross-origin requests targeting AVideo API endpoints

How to Mitigate CVE-2026-92582

Immediate Actions Required

Restrict access to objects/videoAddNew.json.php at the web server or reverse proxy layer to trusted IP ranges until a vendor patch is available
Enforce strict SameSite=Strict cookie attributes on AVideo session cookies to block cross-origin cookie attachment
Audit the videos table for unauthorized ownership transfers, password changes, and permission modifications
Require administrators to log out of AVideo when browsing untrusted content

Patch Information

No patched version was available at the time of the advisory. Monitor the WWBN/AVideo GitHub repository and the GitHub Security Advisory GHSA-qf9p-jhx7-rhmf for a released fix, and apply it immediately upon publication.

Workarounds

Block requests to objects/videoAddNew.json.php that contain user or pass query parameters using a web application firewall (WAF) rule
Remove or rename objects/videoAddNew.json.php if the endpoint is not required by front-end functionality
Enforce Origin and Referer header validation for state-changing AVideo endpoints at the reverse proxy
Limit AVideo upload and administrator accounts to dedicated browsers or sessions isolated from general web browsing

bash

# Example nginx rule to block CSRF exploitation attempts
location /objects/videoAddNew.json.php {
    if ($arg_user) { return 403; }
    if ($arg_pass) { return 403; }
    if ($http_origin !~* ^https://avideo\.example\.com$) { return 403; }
}