Cross-Site Request Forgery in AVideo by WWBN

CVE-2026-83595

What is CVE-2026-83595?

AVideo has a cross-site request forgery vulnerability located in the plugin/API/set.json.php file. This flaw enables attackers to exploit it by crafting malicious GET requests that bypass existing CSRF protections. By directing a victim's browser to a harmful URL containing specific API parameters, attackers gain the ability to perform state-altering actions such as deleting videos, deactivating user accounts, or altering playlists without any user interaction. This vulnerability underscores the importance of robust CSRF protection mechanisms in web applications.

References