CVE-2026-92581: AVideo through 29.0 Like Counter Desynchronization via Array Parameter
In AVideo through 29.0, Like::construct() performs counter arithmetic on raw request values before validation, allowing array-typed parameters to desynchronize stored votes from counters. Authenticated attackers can send array-typed like parameters followed by ordinary requests to drive video like counts arbitrarily negative, with the corruption persisting in the denormalized counter until manual repair.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs to be authenticated and able to submit like requests with array-typed parameters. No user interaction is required.
What is the practical impact of a successful exploit?
An attacker can desynchronize stored vote records from the denormalized video like counter and drive the displayed like count arbitrarily negative. The issue affects integrity of like-count data; confidentiality and availability impacts are not indicated.
How can teams tell whether they may already be affected?
Look for videos whose stored vote data does not match their displayed or stored like counter, particularly negative like counts. The corruption persists until the denormalized counter is manually repaired.
What can be done if patching is not immediately possible?
Restrict or monitor authenticated access to like functionality and reject array-typed values for like parameters before they reach the application logic. Manually repair counters that have already become inconsistent.