CVE-2026-89148: AVideo Open Redirect via playlistSort.php Referer Header
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an open redirect in objects/playlistSort.php. Because the endpoint is not a .json.php script, AVideo's automatic CSRF guard (autoCSRFGuard()/forbidIfIsUntrustedRequest()) does not run, and when the request includes the sort parameter the script issues a Location header set to the unvalidated $SERVER['HTTPREFERER'] value without calling isSafeRedirectURL(). A remote unauthenticated attacker can therefore induce a logged-in user who can manage the targeted playlist to submit a cross-origin POST with a crafted Referer, causing the victim's playlist to be reordered and the victim's browser to be redirected from a trusted AVideo URL to an attacker-controlled site for phishing. No patched version is available.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AVideoto a version that resolves this vulnerability.Patch c3edcc274c389816d434acadac07ee78eaf330c1 - Configuration
Modify objects/playlistSort.php so that when sort is provided and a Location redirect is returned, the redirect target is validated with isSafeRedirectURL() and never directly uses unvalidated $_SERVER['HTTP_REFERER'].
AVideo objects/playlistSort.php Redirect target validation (isSafeRedirectURL) for Location header = Use isSafeRedirectURL() instead of unvalidated $_SERVER['HTTP_REFERER'] - Compensating control
Add a protective CSRF/untrusted-request guard (similar to autoCSRFGuard()/forbidIfIsUntrustedRequest()) for non-*.json.php endpoints like objects/playlistSort.php so cross-origin POSTs with crafted Referer are rejected.
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Users who are logged in and have permission to manage the playlist targeted by the request are exposed. The attacker does not need an account, but must induce such a user to submit a cross-origin POST.
What are the practical impacts of a successful attack?
The victim's targeted playlist can be reordered, and the victim's browser can be redirected from the AVideo site to an attacker-controlled site. The redirect can support phishing by making the transition appear to originate from a trusted AVideo URL.
Are installations protected by AVideo's automatic CSRF guard?
Not for this endpoint. objects/playlistSort.php is not a *.json.php script, so autoCSRFGuard()/forbidIfIsUntrustedRequest() does not run for the affected request path.
What can be done while no patch is available?
No vendor patch is available in the provided data. Reduce exposure by preventing untrusted cross-origin POST requests from reaching playlistSort.php where possible and warning playlist managers about phishing or unsolicited links that may trigger actions while they are logged in.