The vulnerability in WWBN AVideo's SocialMediaPublisher plugin arises from missing authorization checks in the add.json.php endpoint. Authenticated users can manipulate the endpoint to specify arbitrary database row IDs, enabling them to overwrite OAuth tokens (access_token and refresh_token) belonging to other users. After modifying these tokens, attackers can delete the victim's token record, effectively severing the victim's connection to the OAuth provider. This flaw allows unauthorized modification and deletion of sensitive authentication tokens within the application.

An attacker with authenticated access can hijack or disrupt other users' OAuth token records, potentially causing denial of service for the victim's linked social media accounts or enabling unauthorized actions if tokens are reused. The integrity and availability of OAuth token data are compromised, impacting user account linkage and potentially leading to further abuse within the application context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the SocialMediaPublisher plugin's add.json.php endpoint to trusted users only and monitor for suspicious activity related to OAuth token modifications.