CVE-2026-89148 WWBN CVE debrief

Who should care

AVideo administrators and users, as well as security teams responsible for monitoring and protecting against phishing attacks, should be aware of this vulnerability and take steps to mitigate its impact.

Why it matters

The CVE-2026-89148 open redirect vulnerability in AVideo poses a medium risk of phishing attacks against users, particularly those with management privileges for playlists. Administrators and security teams should prioritize verifying and applying patches, monitoring for potential attacks, and educating users on the risks and mitigations.

• Potential phishing attacks against AVideo users
• Unauthorized reordering of playlists
• Redirects to attacker-controlled sites
• Verification of AVideo installations and user education required

Technical summary

The AVideo application contains an open redirect vulnerability in the objects/playlistSort.php file. This vulnerability allows an unauthenticated attacker to induce a logged-in user to submit a cross-origin POST request with a crafted Referer, potentially leading to phishing attacks. The vulnerability exists because the endpoint is not a *.json.php script, AVideo's automatic CSRF guard (autoCSRFGuard()/forbidIfIsUntrustedRequest()) does not run, and when the request includes the sort parameter the script issues a Location header set to the unvalidated $_SERVER['HTTP_REFERER'] value without calling isSafeRedirectURL(). AVideo administrators and users should prioritize verifying and applying any available patches

Defensive priority

AVideo administrators and users should prioritize verifying and applying any available patches or updates to prevent potential phishing attacks.

Recommended defensive actions

• Verify and apply any available patches or updates for AVideo
• Monitor AVideo installations for potential phishing attacks
• Educate users on the risks of phishing attacks and the importance of verifying URLs
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

The CVE record and NVD entry provide details on the open redirect vulnerability in AVideo, including the affected commit and the potential impact of phishing attacks. The vulnerability exists in the objects/playlistSort.php file and allows an unauthenticated attacker to induce a logged-in user to submit a cross-origin POST request with a crafted Referer, potentially leading to phishing attacks. AVideo administrators and users should verify and apply any available patches or updates to prevent potential phishing attacks. Evidence is A

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.