CVE-2026-86725: AVideo SocialMediaPublisher Missing Authorization via add.json.php
AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in the SocialMediaPublisher plugin's add.json.php endpoint that allows authenticated users to modify other users' OAuth token records. Attackers can supply arbitrary row IDs to overwrite another user's stored accesstoken and refreshtoken, then delete the compromised record to destroy the victim's provider linkage.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated AVideo user can exploit it; no elevated privileges or user interaction are required. The affected functionality is the SocialMediaPublisher plugin's add.json.php endpoint.
What access does an attacker need to modify another user's provider linkage?
The attacker needs a valid authenticated account and the ability to submit an arbitrary OAuth token-record row ID to the endpoint. They can overwrite the target record's access_token and refresh_token and then delete the record.
What is the practical impact on a targeted user?
An attacker can replace another user's stored OAuth tokens and delete the compromised token record. This can destroy the victim's linkage to the associated OAuth provider and affect the integrity and availability of that integration.
How can administrators determine whether their installation is affected?
Installations using the AVideo SocialMediaPublisher plugin are affected if they include the vulnerable add.json.php implementation described as present through commit c3edcc274c389816d434acadac07ee78eaf330c1. Review whether that endpoint accepts row IDs without verifying that the authenticated user owns the corresponding OAuth token record.