Cross-Site Request Forgery in AVideo Plugin

Executive Summary

CVE-2026-83595 is a Cross-Site Request Forgery (CSRF) vulnerability in AVideo's plugin/API/set.json.php endpoint. It allows attackers to perform unauthorized state-changing actions via crafted GET requests that bypass CSRF protection. The application only checks CSRF tokens for POST requests, leaving GET requests vulnerable. Attackers can trick victims into visiting malicious URLs to delete videos, deactivate accounts, or modify playlists without interaction.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor network traffic for GET requests to the plugin/API/set.json.php endpoint that perform state-changing actions like deleting videos or modifying playlists. Check server logs for unusual API calls with parameters indicating unauthorized actions.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized actions like deleting videos, deactivating accounts, or modifying playlists without your knowledge. Attackers can exploit it by tricking you into clicking a malicious link, potentially causing data loss or account compromise. The high CVSS scores (8.1 and 7.2) indicate significant integrity and availability risks.

Useful 0 Not Useful 0

Compliance Impact

This CSRF vulnerability could lead to unauthorized actions such as deleting videos, deactivating accounts, or modifying playlists without user consent. For GDPR, this may violate principles of data protection and user rights, potentially leading to unauthorized data loss or modification. For HIPAA, unauthorized changes to user accounts or content could compromise protected health information integrity and availability.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update AVideo to a patched version if available. As a temporary measure, disable GET requests to the plugin/API/set.json.php endpoint or enforce CSRF checks for all requests carrying session cookies, ensuring they must be POST requests.

Useful 0 Not Useful 0