WWBN AVideo contains a CSRF vulnerability in the deleteHistory.json.php and finishAll.json.php scripts, introduced by commit c3edcc274c389816d434acadac07ee78eaf330c1. The vulnerability permits unauthenticated attackers to mutate live transmission history by exploiting the lack of CSRF token validation on GET requests. Attackers can craft malicious web pages that trigger administrator browsers to execute these state-changing actions without their consent. The CVSS 4.0 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, and high impact on integrity. No vendor advisory or patch information is provided, and the vulnerability is not related to a cloud service.

An attacker can cause an administrator's browser to perform unauthorized actions such as deleting live transmission history or marking streams as finished. This can disrupt live streaming operations and potentially affect service availability or data integrity related to live transmissions. The vulnerability requires user interaction (the admin visiting a malicious page) but no authentication or privileges are needed by the attacker.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid visiting untrusted websites while logged into the AVideo administrative interface. Implementing CSRF protections such as requiring tokens on state-changing requests and changing GET requests to POST where appropriate is recommended once a patch is released.