AVideo contains a CSRF vulnerability due to an open redirect in objects/playlistSort.php. This endpoint is not a *.json.php script, so AVideo's automatic CSRF guard functions do not execute. When the 'sort' parameter is included, the script issues a Location header redirecting to the unvalidated HTTP Referer header without verifying if the URL is safe. This allows a remote unauthenticated attacker to cause a logged-in user who can manage playlists to reorder the playlist and be redirected to a malicious site, facilitating phishing attacks.

An attacker can trick a logged-in user with playlist management rights into submitting a cross-origin POST request that reorders the user's playlist and redirects the user's browser to an attacker-controlled URL. This can lead to unauthorized modification of playlist content and phishing via redirection from a trusted domain. The vulnerability requires the victim to be authenticated and have playlist management privileges.

No official patch or fix is currently available for this vulnerability. Users and administrators should monitor vendor advisories for updates. Until a fix is released, consider restricting access to playlist management features or implementing additional CSRF protections and referer validation as a temporary mitigation.