CVE-2026-89245 WWBN CVE debrief

Who should care

Defenders responsible for AVideo installations should assess exposure to this CSRF vulnerability and prioritize verification and remediation efforts. AVideo system administrators should verify their installations, implement CSRF protection checks, and monitor for suspicious activity. Defenders should prioritize verifying exposure of AVideo installations to this CSRF vulnerability and assess the impact of potential playlist deletion.

Why it matters

Defenders should prioritize verifying exposure of AVideo installations to this CSRF vulnerability and assess the impact of potential playlist deletion. The vulnerability allows attackers to delete playlists by crafting a malicious form, which can be triggered when a victim visits the attacker's page while logged in. AVideo system administrators should verify their installations, implement CSRF protection checks, and monitor for suspicious activity.

• Potential deletion of playlists by attackers
• Possible disruption of AVideo system functionality
• Need for verification of AVideo installations for exposure
• Priority for implementing CSRF protection checks

Technical summary

The WWBN AVideo application contains a cross-site request forgery (CSRF) vulnerability in the playlistRemove.php file. This vulnerability allows attackers to delete playlists by crafting a malicious form that submits a POST request to playlistRemove.php, which can be triggered when a victim visits the attacker's page while logged in. The vulnerability can be exploited by attackers to delete playlists, potentially disrupting AVideo system functionality. AVideo system administrators should verify their installations, implement CSRF protection checks, and monitor for suspicious activity. The CVE record and NVD entry provide details on the CSRF vulnerability in WWBN AVideo, specifically in playlistRemove.php.

Defensive priority

Defenders should prioritize verifying exposure of AVideo installations to this CSRF vulnerability and assess the impact of potential playlist deletion.

Recommended defensive actions

• Verify AVideo installations for exposure to this CSRF vulnerability
• Assess the impact of potential playlist deletion on AVideo systems
• Implement CSRF protection checks for playlistRemove.php
• Monitor AVideo systems for suspicious playlist deletion activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the CSRF vulnerability in WWBN AVideo, specifically in playlistRemove.php. The vulnerability allows attackers to delete playlists by crafting a malicious form that submits a POST request, which can be triggered when a victim visits the attacker's page while logged in.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.