Cross-Site Request Forgery Vulnerability in AVideo by WWBN

CVE-2026-86719

What is CVE-2026-86719?

AVideo has a vulnerability in its CustomizeUser plugin that exposes users to cross-site request forgery (CSRF) attacks. An attacker can exploit this by getting an authenticated administrator's session to issue a cross-origin GET request, potentially substituting their session with that of a non-admin user. The attack is facilitated by insufficient safeguards, allowing the targeted action to be executed without proper checks, which can lead to administrative access loss for the victim. Moreover, the JSON response from the affected endpoint inadvertently discloses the session ID, further compromising user security. As the CustomizeUser plugin is enabled by default and no patch was available at the time of reporting, this poses an immediate risk to users of AVideo.

References