The vulnerability in WWBN AVideo (<=29.0) is a CSRF issue in the comment deletion JSON endpoint. This endpoint mutates state by deleting comments but lacks CSRF validation mechanisms including token checks and origin/referrer verification. The platform's use of session.cookie_samesite=None causes the victim's PHPSESSID cookie to be sent automatically with cross-site requests, enabling attackers to perform unauthorized comment deletions if the victim is authenticated and authorized. The vulnerability affects site moderators, video owners, and comment authors who can delete comments. A code commit has been made to fix this issue.

An attacker can cause an authenticated user with comment deletion privileges to unknowingly delete comments by tricking them into visiting a malicious webpage. This results in unauthorized comment deletions (integrity loss) and potential denial of service to comment functionality (availability impact). There is no direct confidentiality impact reported. The CVSS score of 5.4 (medium severity) reflects the moderate impact and ease of exploitation requiring user interaction.

A fix has been implemented as indicated by the referenced commit (184f36b1896f3364f864f17c1acca3dd8df3af27). Users should update to a version including this fix to ensure CSRF protections are in place on the comment deletion endpoint. Until patched, administrators should be aware of the risk and consider restricting comment deletion privileges or implementing additional protective measures. Patch status is not explicitly confirmed in vendor advisories; therefore, verify the fix availability and apply updates accordingly.