CVE-2026-92582 is a CSRF vulnerability in WWBN AVideo through version 29.0 (commit e01e41ecc). The endpoint objects/videoAddNew.json.php disables the automatic CSRF guard and bypasses same-domain checks if 'user' and 'pass' parameters are present, but these parameters are never validated and are read directly from $_REQUEST. Because User::loginFromRequestIfNotLogged() returns immediately if a session exists, an authenticated victim's session is used while attacker-supplied credentials are ignored. This allows an attacker to submit cross-origin requests that modify video metadata, including ownership transfer, access restrictions, download/share permissions, passwords, ratings, status, creation date, and view count. Administrators or users with Permissions::canAdminVideos() rights can alter any video, including removing private content restrictions. No patch or fix was available at the time of publication.

An attacker can exploit this vulnerability to perform unauthorized modifications to video records by tricking authenticated users with upload or administrative rights into submitting malicious cross-origin requests. This can lead to unauthorized changes such as transferring video ownership, removing access restrictions, altering download and sharing permissions, changing video passwords, and modifying other metadata. The impact is significant for users with elevated privileges, potentially compromising video content confidentiality and integrity.

No official patch or fix was available at the time of the advisory. Users should apply strict access controls and avoid visiting untrusted sites while authenticated with upload or administrative privileges. Monitor for updates from the vendor for an official fix and apply it promptly once available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.