WWBN AVideo versions 26.0 and prior contain a CSRF vulnerability in the emailAllUsers.json.php endpoint. This endpoint allows authenticated administrators to send HTML emails to all users but lacks CSRF token validation. The platform sets session cookies with SameSite=None, allowing cross-origin POST requests to include the admin's session cookie automatically. An attacker who tricks an admin into visiting a malicious webpage can exploit this to send arbitrary HTML emails to all users, potentially enabling phishing or other social engineering attacks. No official patch or fix is available as of the publication date.

An attacker can leverage this vulnerability to send arbitrary HTML emails to every registered user on the affected AVideo platform instance. These emails appear to originate from the legitimate SMTP address configured on the platform, increasing the likelihood of successful phishing or social engineering attacks. The vulnerability does not disclose confidential data or allow direct system compromise but can significantly impact user trust and platform reputation. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should avoid visiting untrusted websites while logged into the AVideo platform. Additionally, consider implementing network-level protections or web application firewall rules to restrict access to the vulnerable endpoint or require additional verification for email-sending actions. Monitoring for unusual email activity may also help detect exploitation attempts.