CVE-2026-86724: AVideo YPTWallet saveBalance.php Cross-Site Request Forgery
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in plugin/YPTWallet/view/saveBalance.php that allows attackers to set arbitrary wallet balances by relying only on session cookies without token validation. Attackers can craft a malicious webpage that, when loaded by an administrator, submits a POST request to modify any user's wallet balance to any value.
Affected Software
Event History
Frequently Asked Questions
Who must interact with an attacker-controlled page for exploitation to succeed?
An administrator must load the malicious webpage while authenticated to AVideo. The attack relies on that administrator's session cookies being sent with the forged POST request.
What can an attacker change through the forged request?
The attacker can modify any user's wallet balance and set it to an arbitrary value. No attacker account or prior privileges are stated as required.
How can defenders determine whether this endpoint lacks CSRF protection?
Review plugin/YPTWallet/view/saveBalance.php for POST requests that rely only on session cookies and do not validate a CSRF token. The affected code is present through commit c3edcc274c389816d434acadac07ee78eaf330c1.