WWBN AVideo up to version 29.0 has CSRF vulnerabilities in multiple JSON endpoints under 'objects/'. These endpoints process state-changing requests via $_REQUEST/$_GET without verifying anti-CSRF tokens or origin headers, allowing attackers to perform unauthorized actions on behalf of authenticated users. Exploitation requires only that the victim loads attacker-controlled HTML content, which can trigger actions such as flipping likes/dislikes on comments, posting arbitrary comments, or deleting category assets if permitted. The issue is addressed in a specific code commit.

Exploitation allows attackers to perform unauthorized state changes in the application as the victim user, including modifying comment likes, posting comments with arbitrary content, and deleting assets in categories where the victim has management rights. This can lead to integrity loss of user interactions and potential data loss. There is no indication of confidentiality or availability impact beyond these actions. No known exploits in the wild have been reported.

A fix for this vulnerability is available in the codebase as indicated by commit 7aaad601bd9cd7b993ba0ee1b1bea6c32ee7b77c. Users of WWBN AVideo should upgrade to a version including this commit or apply the patch to implement proper anti-CSRF protections such as tokens or origin checks on affected endpoints. Since the vendor advisory or patch links are not explicitly provided, verify the fix by reviewing the referenced commit in the project repository. Until patched, users should be cautious about visiting untrusted web pages while authenticated to the affected AVideo instance.