CVE-2026-89251: AVideo Missing Authorization via AD_Server log.php Wallet Credit
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate ad impressions in plugin/ADServer/log.php, allowing logged-in users to submit arbitrary label values that trigger unverified wallet credits to campaign video owners. Attackers can repeatedly POST label=start requests to mint YPTWallet balance for any campaign video without proof an ad actually played.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs to be logged in to AVideo and able to send POST requests to the affected AD_Server logging endpoint. No user interaction or actual advertisement playback is required.
What is the practical impact of exploitation?
A logged-in attacker can repeatedly submit label=start requests for campaign videos and cause unverified YPTWallet credits to be issued to those videos' owners. This affects wallet balance integrity rather than confidentiality or service availability.
Are normal ad-impression checks sufficient to prevent abuse?
No. The affected endpoint does not validate that an ad impression occurred before issuing the wallet credit, so an attacker can mint credits without proof that the ad played.
What can be done if an update is not immediately available?
Restrict access to the affected AD_Server logging endpoint to trusted application traffic and monitor for repeated or anomalous label=start POST requests. Review wallet-credit activity for campaign videos that lacks corresponding verified ad-play evidence.