The vulnerability in WWBN AVideo (<= 26.0) involves the site customization endpoint admin/customize_settings_nativeUpdate.json.php, which does not validate CSRF tokens. Uploaded logo files are written to disk prior to the ORM's domain-based security check, allowing an attacker to exploit the SameSite=None cookie policy to perform a cross-origin POST request. This can result in the platform's logo being overwritten with attacker-controlled content, representing an integrity impact without confidentiality or availability effects. The CVSS 3.1 base score is 4.3, reflecting a medium severity with no privileges required but user interaction needed.

An attacker can overwrite the platform's logo with arbitrary content via a cross-origin POST request exploiting the lack of CSRF protection and the SameSite=None cookie policy. This impacts the integrity of the platform's branding assets but does not affect confidentiality or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoint and consider implementing manual CSRF protections or disabling the vulnerable feature. Monitor for any updates from WWBN regarding an official patch or mitigation.