The vulnerability in WWBN AVideo (commit c3edcc274c389816d434acadac07ee78eaf330c1) is a CSRF issue affecting the setPassword.json.php endpoint. It permits unauthenticated attackers to alter any user's channel password by sending a GET request without requiring a valid CSRF token. This attack relies on tricking an authenticated administrator into visiting a malicious webpage, which then executes the unauthorized password modification. The CVSS 4.0 base score is 7.1, indicating a high severity level due to the ease of attack and potential impact on user account security.

An attacker can change or clear any user's channel password without authentication by exploiting the CSRF vulnerability. This could lead to unauthorized access or denial of access to user channels, compromising the integrity and availability of user accounts on the platform.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid visiting untrusted webpages while authenticated and consider implementing additional CSRF protections or access controls on the affected endpoint.