CVE-2020-37158: AVideo Platform 8.1 - Cross Site Request Forgery (Password Reset)

Published Feb 11, 2026

Updated

AVideo Platform 8.1 contains a cross-site request forgery vulnerability that allows attackers to reset user passwords by exploiting the password recovery mechanism. Attackers can craft malicious requests to the recoverPass endpoint using the user's recovery token to change account credentials without authentication.

Affected Software

2 affected components

AVideo AVideo Platform

WWBN AVideo=8.1

Event History

Feb 11, 2026

CVE Published

via MITRE·08:49 PM

Data Sourced

via MITRE·08:49 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:16 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2020-37158?

The severity of CVE-2020-37158 is considered medium due to its potential to allow unauthorized password resets.

How do I fix CVE-2020-37158?

To fix CVE-2020-37158, implement anti-CSRF tokens in the password recovery mechanism to validate requests.

What type of vulnerability is CVE-2020-37158?

CVE-2020-37158 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the AVideo Platform.

What can attackers do with CVE-2020-37158?

Attackers can exploit CVE-2020-37158 to reset user passwords without authorization, gaining access to user accounts.

Which software versions are affected by CVE-2020-37158?

CVE-2020-37158 affects AVideo Platform version 8.1.