CVE-2026-86724

Deferred Deferred - Pending Action

Cross-Site Request Forgery in AVideo Wallet Plugin

Publication date: 2026-09-08

Last updated on: 2026-09-10

Assigner: VulnCheck

Description

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in plugin/YPTWallet/view/saveBalance.php that allows attackers to set arbitrary wallet balances by relying only on session cookies without token validation. Attackers can craft a malicious webpage that, when loaded by an administrator, submits a POST request to modify any user's wallet balance to any value.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-10

Generated

2026-09-29

AI Q&A

2026-09-09

EPSS Evaluated

2026-09-27

NVD

CVE-2026-86724

Affected Vendors & Products

Vendor	Product	Version / Range
avideo	avideo	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

AVideo has a cross-site request forgery (CSRF) vulnerability in the plugin/YPTWallet/view/saveBalance.php file. This flaw allows attackers to manipulate wallet balances by tricking administrators into loading a malicious webpage. The attack relies on session cookies alone, without proper token validation, enabling unauthorized balance changes for any user.

Detection Guidance

To detect this CSRF vulnerability in AVideo, inspect network traffic for POST requests to plugin/YPTWallet/view/saveBalance.php without CSRF tokens. Check server logs for unusual wallet balance modifications or repeated POST requests from unknown sources.

Impact Analysis

If exploited, attackers could set arbitrary wallet balances for users, leading to financial losses or fraud. Administrators or users with access to the system could unknowingly trigger these changes by visiting a malicious site, compromising the integrity of wallet balances.

Mitigation Strategies

Immediately update AVideo to the latest commit or patch that addresses this issue. Implement CSRF tokens in all forms, especially for sensitive actions like wallet balance modifications. Review and restrict access to plugin/YPTWallet/view/saveBalance.php.

Hi! I’m here to help you understand CVE-2026-86724. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70