Threats tagged 'ghsa-mqr3-w6qc-2c4f'

WWBN AVideo versions through 30.0 (and master up to commit 4cb576e) contain a cross-site request forgery (CSRF) vulnerability in the plugin/Live/myLiveControls.save.json.php endpoint. This endpoint processes certain parameters via a GET request without enforcing CSRF tokens or origin checks, relying only on user login status. An attacker can exploit this by tricking a logged-in streamer into visiting a malicious page, which silently changes live-channel viewer redirect settings to redirect viewers to phishing sites or display spoofed messages.