CVE-2026-89148 WWBN CVE debrief

Who should care

AVideo administrators, users, and security teams should assess exposure and prioritize verification and remediation efforts due to the open redirect vulnerability in objects/playlistSort.php. The vulnerability allows an unauthenticated attacker to redirect a logged-in user's browser to a malicious site for phishing. AVideo installations may be targeted for exploitation, and verification of AVideo installations and user education are necessary.

Why it matters

The CVE-2026-89148 open redirect vulnerability in AVideo's playlistSort.php script allows an unauthenticated attacker to redirect a logged-in user's browser to a malicious site for phishing, requiring verification and remediation efforts from AVideo administrators and users.

• Phishing attacks may be conducted by exploiting the open redirect vulnerability.
• Logged-in users' browsers can be redirected to malicious sites.
• AVideo installations may be targeted for exploitation.
• Verification of AVideo installations and user education are necessary.

Technical summary

The AVideo playlistSort.php script does not run the automatic CSRF guard due to its URL, allowing an attacker to induce a logged-in user to reorder their playlist and redirect their browser to a malicious site. The script issues a Location header set to the unvalidated $_SERVER['HTTP_REFERER'] value without calling isSafeRedirectURL(), enabling an unauthenticated attacker to conduct phishing attacks. AVideo administrators and users should prioritize verifying and updating their installations to prevent potential phishing attacks.

Defensive priority

AVideo administrators and users should prioritize verifying and updating their installations to prevent potential phishing attacks.

Recommended defensive actions

• Verify AVideo installations for the vulnerable script and update or patch as available.
• Restrict access to the playlistSort.php script to trusted users and networks.
• Monitor AVideo logs for suspicious Referer header activity.
• Educate AVideo users on phishing attacks and safe browsing practices.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the open redirect vulnerability in AVideo's playlistSort.php script. The vulnerability allows an unauthenticated attacker to redirect a logged-in user's browser to a malicious site for phishing. The script does not run the automatic CSRF guard due to its URL, and when the request includes the sort parameter, the script issues a Location header set to the unvalidated $_SERVER['HTTP_REFERER'] value without calling isSafeRedirectURL(). AVideo administrators and users should prioritize

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.