CVE-2026-89148
Received Received - Intake

Open Redirect Vulnerability in AVideo

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: VulnCheck

Description
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an open redirect in objects/playlistSort.php. Because the endpoint is not a *.json.php script, AVideo's automatic CSRF guard (autoCSRFGuard()/forbidIfIsUntrustedRequest()) does not run, and when the request includes the sort parameter the script issues a Location header set to the unvalidated $_SERVER['HTTP_REFERER'] value without calling isSafeRedirectURL(). A remote unauthenticated attacker can therefore induce a logged-in user who can manage the targeted playlist to submit a cross-origin POST with a crafted Referer, causing the victim's playlist to be reordered and the victim's browser to be redirected from a trusted AVideo URL to an attacker-controlled site for phishing. No patched version is available.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-11
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-89148
EUVD
EUVD-2026-76050

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
avideo avideo *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-89148 is an open redirect vulnerability in AVideo's playlistSort.php file. It combines with a CSRF flaw to allow attackers to reorder a victim's playlist and redirect them to a malicious site. The issue occurs because the endpoint bypasses AVideo's CSRF protection, and the Referer header is used without validation to set a redirect location.

Detection Guidance

To detect this vulnerability, monitor network traffic for POST requests to objects/playlistSort.php with the sort parameter. Check for redirects to untrusted domains in the Referer header. Use tools like Wireshark or tcpdump to capture and analyze HTTP requests targeting this endpoint.

Impact Analysis

An attacker could trick a logged-in user with playlist management rights into clicking a malicious link. This would reorder their playlist and redirect them to a phishing site, potentially stealing credentials or installing malware. The attack requires cross-origin POST requests with a crafted Referer header.

Mitigation Strategies

Immediately disable or restrict access to objects/playlistSort.php. Implement strict input validation for the Referer header. Disable CSRF bypass by ensuring all endpoints use autoCSRFGuard(). Monitor for suspicious POST requests to this file.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89148. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart