CVE-2026-92582: AVideo through 29.0 Broken Access Control via videoAddNew.json.php CSRF Bypass
AVideo (WWBN/AVideo) through 29.0 (commit e01e41ecc) is vulnerable to cross-site request forgery. objects/videoAddNew.json.php disables AVideo's automatic CSRF guard ($global['skipAutoCSRFCheck']) and the untrusted-request check ($global['bypassSameDomainCheck']) merely because 'user' and 'pass' parameters are present in the request; the values are never validated and are read from $REQUEST, so an attacker can supply them in the query string of a cross-site request. Because User::loginFromRequestIfNotLogged() returns immediately when a session already exists, a victim who is authenticated by cookie satisfies the check while the attacker-supplied credentials are discarded. An attacker who lures an authenticated user with upload rights to visit a crafted page can therefore submit cross-origin requests that modify video records — including ownership transfer (setUsersid), deletion of user-group access restrictions, candownload, canshare, onlyforpaid, videopassword, rating, status, creation date, and view count. For a victim with administrator or Permissions::canAdminVideos() rights, any video on the site can be altered, including removing group restrictions from private content. No patched version was available at the time of the advisory.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Do not disable AVideo's automatic CSRF guard. Remove/avoid any setting or code path that sets $global['skipAutoCSRFCheck'] (the advisory notes objects/videoAddNew.json.php disables it).
AVideo (WWBN/AVideo) $global['skipAutoCSRFCheck'] = false (do not disable) - Configuration
Do not bypass the untrusted-request/same-domain check. Remove/avoid any setting or code path that sets $global['bypassSameDomainCheck'] (the advisory notes objects/videoAddNew.json.php bypasses it).
AVideo (WWBN/AVideo) $global['bypassSameDomainCheck'] = false (do not bypass) - Compensating control
Apply a network-level mitigation for CSRF against the affected JSON endpoint (objects/videoAddNew.json.php): restrict/limit cross-origin access by preventing browser-based cross-site requests (e.g., via WAF rules targeting CSRF/CORS misuse patterns for this endpoint) while the vendor fix is unavailable.
Event History
Frequently Asked Questions
Which users are meaningful CSRF targets?
An attacker needs to induce a user who is already authenticated by cookie and has upload rights to visit a crafted page. The existing authenticated session is used even though the cross-site request includes attacker-controlled user and pass parameters.
How does the impact differ for administrators?
A user with administrator or Permissions::canAdminVideos() rights can alter any video on the site. This includes removing user-group restrictions from private content, whereas other affected users can modify video records within the scope of their rights.
What changes can an attacker make through the vulnerable endpoint?
The request can modify video ownership, user-group access restrictions, download and sharing settings, paid-only status, video passwords, ratings, publication status, creation dates, and view counts. Ownership can be transferred with setUsers_id.
Which installations should be considered affected?
The issue is reported in WWBN/AVideo through version 29.0, including commit e01e41ecc. The vulnerable behavior is in objects/videoAddNew.json.php, where CSRF and same-domain checks are bypassed based on the presence of user and pass request parameters.