WWBN AVideo Affected by CSRF on Player Skin Configuration via admin/playerUpdate.json.php

The primary impact of this CSRF vulnerability lies in the ability of an attacker to manipulate the visual presentation of the AVideo platform. By crafting malicious requests, an attacker can alter the video player's skin, potentially injecting unwanted branding, misleading content, or even malicious scripts. This could damage the platform's reputation, confuse users, or serve as a stepping stone for further attacks. The ignoreTableSecurityCheck() function bypasses the ORM's security checks, amplifying the potential impact. Combined with SameSite=None cookies, the vulnerability can be exploited from cross-origin domains.

Organizations and individuals using AVideo for hosting and streaming video content are at risk. Specifically, deployments with weak cookie security settings (SameSite=None) are more vulnerable. Shared hosting environments where multiple users share the same AVideo instance are also at increased risk, as an attacker could potentially exploit the vulnerability on behalf of another user.

• php: Examine web server access logs for suspicious POST requests to /admin/playerUpdate.json.php originating from unexpected IP addresses.

grep -i 'playerUpdate.json.php' /var/log/apache2/access.log | grep -i 'POST' | grep -v '127.0.0.1'

• php: Review AVideo configuration files for any instances of ignoreTableSecurityCheck() that might be disabling security checks.

grep -r ignoreTableSecurityCheck /var/www/avideo/

• generic web: Monitor for unusual changes in the video player's appearance across the platform, which could indicate a successful CSRF attack.

1. 2026-04-06Disclosure

   disclosure

1. Reserviert2026-04-01
2. Veröffentlicht2026-04-06
3. Geändert2026-04-07
4. EPSS aktualisiert2026-04-14

The recommended mitigation is to immediately upgrade AVideo to version 26.1 or later, which includes the necessary CSRF token validation. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) or proxy rules to filter requests to the admin/playerUpdate.json.php endpoint, specifically blocking requests without valid CSRF tokens. Additionally, ensure that the SameSite cookie attribute is set to Strict or Lax to prevent cross-origin requests from triggering the vulnerability. Verify the upgrade by attempting to modify the player skin through a different browser session without authentication; the request should be rejected.