Missing Authorization in AVideo SocialMediaPublisher Plugin
CVE-2026-86725

7.1HIGH

Key Information:

Vendor

Wwbn

Status
Avideo
Vendor
CVE Published:
8 September 2026

What is CVE-2026-86725?

AVideo's SocialMediaPublisher plugin has a vulnerability in the add.json.php endpoint that enables authenticated users to manipulate other users' OAuth token records. By exploiting this flaw, attackers can provide arbitrary row IDs to overwrite existing access and refresh tokens of targeted users. Following this, they can delete the compromised records, dismantling the victim's connection to their social media providers. This vulnerability underscores the importance of robust authorization mechanisms in safeguarding user data from unauthorized alterations.

Affected Version(s)

AVideo 0

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-r...
vendor-advisory
https://www.vulncheck.com/advisories/avideo-socialmediapu...
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

santhreal
.