CVE-2026-92585: AVideo Authentication Bypass Vulnerability

CVE-2026-92585 Overview

CVE-2026-92585 is a missing authorization vulnerability [CWE-862] in AVideo, an open-source video streaming platform maintained by WWBN. Versions through 29.0, including commit c3edcc274c389816d434acadac07ee78eaf330c1, fail to validate video access permissions in the API like endpoint. Authenticated users can submit like and dislike requests against videos they are not permitted to watch. The flaw affects password-protected and group-restricted content, allowing attackers to manipulate vote counters through the set.json.php endpoint using APIName parameters.

Critical Impact

Any logged-in user can influence engagement metrics on restricted videos without bypassing the underlying access control that protects video playback.

Affected Products

• AVideo platform versions through 29.0
• AVideo commit c3edcc274c389816d434acadac07ee78eaf330c1
• Deployments exposing the set.json.php API endpoint

Discovery Timeline

• 2026-09-16 - CVE-2026-92585 published to the National Vulnerability Database
• 2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92585

Vulnerability Analysis

AVideo exposes a JSON API through the set.json.php endpoint that accepts an APIName parameter to route requests to functions such as like and dislike handlers. The like endpoint records vote actions but does not verify whether the authenticated user has permission to view the target video. Password-protected videos and videos restricted to specific user groups apply access controls at the playback layer, not at the voting layer. As a result, an attacker who has any valid account can submit crafted requests to increment or decrement vote counters on content they are not authorized to access. This produces integrity impact on engagement analytics without exposing the video content itself.

Root Cause

The root cause is a missing authorization check [CWE-862] in the API like handler. The controller trusts that the caller can enumerate a video identifier and treats authentication as sufficient authorization for the vote action. Access control logic that gates playback for password-protected and group-restricted videos is not replicated on the like and dislike code paths.

Attack Vector

The attack requires network access to the AVideo instance and low-privilege authenticated credentials. The attacker sends an HTTP request to set.json.php with an APIName parameter targeting the like or dislike function and a video identifier for restricted content. No user interaction is required. Refer to the GitHub Security Advisory GHSA-rrcx-6vw7-xwj8 and the VulnCheck Advisory for AVideo for parameter-level detail.

Detection Methods for CVE-2026-92585

Indicators of Compromise

• Requests to set.json.php with APIName values targeting like or dislike functions from accounts that never loaded the corresponding video page.
• Sudden shifts in like or dislike counts on videos flagged as password-protected or group-restricted.
• High-frequency vote submissions from a single authenticated session iterating video identifiers.

Detection Strategies

• Correlate authenticated session activity: a vote request without a preceding successful video playback authorization should be treated as suspicious.
• Baseline vote velocity per user and alert on outliers, especially against restricted content categories.
• Review web server access logs for set.json.php?APIName= patterns tied to accounts with limited group memberships.

Monitoring Recommendations

• Forward AVideo web server and application logs into a centralized analytics platform for retention and query.
• Add rules that flag authorization-relevant API endpoints when hit by users lacking playback entitlements.
• Track integrity of engagement metrics on restricted videos and alert on unexpected counter changes.

How to Mitigate CVE-2026-92585

Immediate Actions Required

• Inventory AVideo deployments and identify instances running version 29.0 or earlier, including the commit c3edcc274c389816d434acadac07ee78eaf330c1.
• Apply the fix referenced in the GitHub Security Advisory GHSA-rrcx-6vw7-xwj8 once available.
• Audit recent like and dislike activity on password-protected and group-restricted videos and roll back tampered counters.

Patch Information

At the time of publication, remediation guidance is tracked in the vendor's GitHub Security Advisory GHSA-rrcx-6vw7-xwj8 and the corresponding VulnCheck Advisory for AVideo. Administrators should upgrade to a release that adds authorization validation to the like and dislike handlers in set.json.php.

Workarounds

• Restrict access to set.json.php at the reverse proxy or web application firewall for endpoints handling vote actions until a patched release is deployed.
• Disable public account registration on affected instances to reduce the pool of low-privilege accounts that can abuse the endpoint.
• Temporarily hide like and dislike functionality in the front-end and reject server-side requests that reference restricted video identifiers.

# Example reverse proxy rule to block vote-related APIName values on set.json.php
# Adjust the location block and APIName list to match your deployment
location = /plugin/API/set.json.php {
    if ($arg_APIName ~* "^(like|dislike)$") {
        return 403;
    }
    proxy_pass http://avideo_backend;
}