CVE-2026-83595: AVideo Cross-Site Request Forgery via plugin/API/set.json.php
AVideo contains a cross-site request forgery vulnerability in plugin/API/set.json.php that allows attackers to perform state-changing actions by crafting GET requests that bypass CSRF protection. Attackers can navigate a victim's browser to a malicious URL with API parameters to delete videos, deactivate accounts, or modify playlists without user interaction.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker needs to cause a victim to navigate to a malicious URL containing API parameters. The attack does not require attacker authentication, but it requires victim interaction in the form of loading the crafted URL.
Who is exposed to the impact?
AVideo users whose browser is authenticated to an affected AVideo instance are exposed. Requests can be made in the context of that user’s session, potentially deleting videos, deactivating accounts, or changing playlists.
Are state-changing API requests protected against this attack?
The affected plugin/API/set.json.php endpoint accepts crafted GET requests that bypass CSRF protection. State-changing actions through this endpoint are therefore affected.