CVE-2026-92582 WWBN CVE debrief

Who should care

Defenders responsible for AVideo installations, particularly those with users who have upload rights, should assess exposure and prioritize verification of request authenticity. They should also consider implementing additional security measures to prevent cross-site request forgery and review compensating controls for exposed systems.

Why it matters

AVideo through version 29.0 is vulnerable to cross-site request forgery, allowing an attacker to modify video records by luring an authenticated user with upload rights to visit a crafted page. Defenders should prioritize verifying request authenticity and consider additional security measures.

• An attacker can modify video records, including ownership transfer and deletion of user-group access restrictions.
• An attacker can submit cross-origin requests that alter video records, potentially leading to unauthorized changes.
• Defenders need to verify the authenticity of requests to videoAddNew.json.php to prevent CSRF attacks.
• A patched version is not available, requiring defenders to implement compensating controls.

Technical summary

The videoAddNew.json.php file in AVideo through version 29.0 disables the automatic CSRF guard and untrusted-request check if 'user' and 'pass' parameters are present in the request. An attacker can supply these parameters in the query string of a cross-site request to modify video records. This allows an attacker to modify video records, including ownership transfer and deletion of user-group access restrictions, by luring an authenticated user with upload rights to visit a crafted page. The vulnerability exists because User::loginFromRequestIfNotLogged() returns immediately when a session already exists, allowing an attacker-supplied credentials to be discarded.

Defensive priority

Defenders should prioritize verifying the authenticity of requests to videoAddNew.json.php and ensuring that users with upload rights are aware of the potential for CSRF attacks.

Recommended defensive actions

• Verify the authenticity of requests to videoAddNew.json.php
• Ensure users with upload rights are aware of the potential for CSRF attacks
• Consider implementing additional security measures to prevent cross-site request forgery
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source references provide information on the vulnerability, but a patched version is not available. The NVD entry is currently Deferred. Defenders should verify the authenticity of requests to videoAddNew.json.php to prevent CSRF attacks. The vulnerability allows an attacker to submit cross-origin requests that alter video records, potentially leading to unauthorized changes. There is no patched version available at the time of the advisory, requiring defenders to implement compensating controls.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.