WWBN AVideo versions up to 29.0 contain a CSRF vulnerability in the objects/userSavePhoto.php endpoint. This endpoint allows authenticated users to upload a base64-encoded image to overwrite their profile photo without CSRF token validation or Origin/Referer checks. The global CSRF protection mechanism excludes this endpoint due to its filename suffix. The default cookie policy (SameSite=None; Secure) on HTTPS enables attackers to exploit this by luring logged-in users to malicious sites, causing arbitrary profile photo overwrites and triggering site-wide cache clearing. A code commit (9c38468041505e637101c5943c5370c68f48e3ac) includes a fix, but no official patch or vendor advisory is currently documented.

The vulnerability allows an attacker to perform CSRF attacks against logged-in users, resulting in arbitrary overwriting of user profile photos with attacker-controlled data. Additionally, each forged request triggers a site-wide cache clear, which may degrade performance or availability. There is no direct confidentiality impact reported. The CVSS score is 5.4 (medium severity), reflecting low complexity and no privileges required but user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The referenced commit contains a fix, but no official patch or advisory is available at this time. Until an official fix is released, users should consider restricting access to the vulnerable endpoint or implementing manual CSRF protections. Monitoring for updates from WWBN is recommended.