Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2026-83595: AVideo API lets attackers delete videos or accounts
CVE-2026-83595 · published 2 months ago
Summary
The AVideo web‑based video platform has a weakness in the file plugin/API/set.json.php that lets a malicious link cause actions such as deleting videos, disabling user accounts or changing playlists without the user’s consent. An attacker can trick a logged‑in user into visiting a crafted URL and the changes happen automatically. Apply the vendor’s latest update or restrict access to that API endpoint to stop the problem.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| wwbn | avideo | <= 29.0 |
Original advisory text
AVideo Cross-Site Request Forgery via plugin/API/set.json.php
AVideo contains a cross-site request forgery vulnerability in plugin/API/set.json.php that allows attackers to perform state-changing actions by crafting GET requests that bypass CSRF protection. Attackers can navigate a victim's browser to a malicious URL with API parameters to delete videos, deactivate accounts, or modify playlists without user interaction.
References
- https://github.com/WWBN/AVideo/security/advisories/GHSA-mwr9-5m78-rhgm Vendor Advisory
- https://www.vulncheck.com/advisories/avideo-cross-site-request-forgery-via-plugi... Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/83xxx/CVE-2026-83595... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-83595 Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
9.1
Critical
Type
CWE-352Cross-Site Request Forgery (CSRF)
Timeline
Published1 Sep 2026
Updated4 Nov 2026
First seen1 Sep 2026
Track software like this
Free during beta