CVE-2026-92579: AVideo through 29.0 Broken Access Control via CSRF Exemption Basename Collision
In AVideo through 29.0, the autoCSRFGuard() function maintains a hardcoded allowlist of exempt basenames tested without directory context, allowing plugin files matching core filenames to inherit CSRF exemptions. The LoginWordPress plugin file login.json.php inherits an exemption and unconditionally logs out authenticated users on cross-site POST requests before validating credentials.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
AVideo installations through 29.0 that have the LoginWordPress plugin file login.json.php present are exposed. The affected behavior targets authenticated users, who can be logged out through a cross-site POST request.
What does an attacker need to exploit it?
An attacker does not need credentials, but must cause an authenticated user to submit or trigger a cross-site POST request to the affected plugin endpoint. User interaction is required.
What is the practical impact?
Successful exploitation unconditionally logs the authenticated user out before credentials are validated. The supplied severity vector indicates integrity and availability impact, with no confidentiality impact.
How can I determine whether my deployment is affected?
Check whether the deployment uses AVideo version 29.0 or earlier and whether the LoginWordPress plugin includes login.json.php. The issue depends on that plugin file receiving a CSRF exemption because its basename collides with an exempt core filename.