CVE-2026-89245: WWBN AVideo Cross-Site Request Forgery via playlistRemove.php
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in playlistRemove.php that allows attackers to delete playlists by skipping CSRF protection checks. Attackers can craft a malicious form that submits a POST request to playlistRemove.php, causing a victim's playlist to be deleted when they visit the attacker's page while logged in.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WWBN AVideoto a version that resolves this vulnerability.Patch c3edcc274c389816d434acadac07ee78eaf330c1
Event History
Frequently Asked Questions
Who is exposed to exploitation?
A logged-in WWBN AVideo user who can be induced to visit an attacker-controlled page is exposed. The attacker does not need an account or prior privileges.
What must an attacker do to trigger the issue?
The attacker must craft a malicious page containing a form that submits a POST request to playlistRemove.php and persuade a logged-in victim to visit it. The victim's browser then submits the request in the context of the victim's active session.
What is the practical impact?
An attacker can cause deletion of a victim's playlist. The provided data identifies integrity impact only; it does not indicate confidentiality or availability impact.