WWBN AVideo before 29.4.0 contains a blind server-side request forgery vulnerability in getHeaderContentTypeFromURL() because get_headers() follows redirects without re-validating targets with isSSRFSafeURL(). Authenticated uploaders can store a videoLink pointing to a redirector, causing internal GET requests when visitors view the video, enabling internal port scanning via the embed-versus-video render oracle.
WWBN AVideo versions before 29.4.0 have an incorrect authorization vulnerability that allows delegated Users Admin accounts to delete or modify administrator accounts. Attackers with such delegated privileges can submit requests to specific endpoints to delete or demote administrators and remove their videos or accounts.
WWBN AVideo versions before 24.0 contain a cross-site request forgery (CSRF) vulnerability in legacy endpoints such as playlistStatus.php. This vulnerability bypasses the autoCSRFGuard() check that applies only to .json.php endpoints. Exploitation can allow attackers to trick logged-in users into performing unauthorized actions like making private playlists public, removing videos from playlists, or forging video suggestions.
WWBN AVideo versions 12.4 through 29.2.0 contain a stored cross-site scripting (XSS) vulnerability. Authenticated uploaders can exploit this by submitting doubly-encoded entities in video titles, bypassing the safeString() sanitization function. This allows injection of malicious HTML that executes in various pages such as trending, gallery, embed, and playlist pages.
WWBN AVideo versions up to 29.2.0 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows users with upload permissions to inject malicious scripts via the video trailer URL, which is rendered without proper escaping in certain templates and playlists. Exploitation can lead to arbitrary JavaScript execution in other users' browsers.
AVideo versions before 29.1.0 contain a stored cross-site scripting (XSS) vulnerability in the video trailer1 field. This field is rendered unsanitized within an inline onclick JavaScript string, allowing attackers with video upload permissions to inject HTML entity-encoded payloads. These payloads bypass URL validation and are decoded by browsers, enabling execution of arbitrary code in visitors' sessions, including administrators. The vulnerability has a medium severity with a CVSS score of 5.1.
WWBN AVideo through commit e01e41ecc (no patched version available) contains a broken access control flaw in objects/userVerifyEmail.php. The script disables the login requirement ($global['ignoreUserMustBeLoggedIn'] = 1), takes users_id directly from the query string, and calls User::sendVerificationLink() with no session requirement, no CSRF/global token, no relationship check between caller and target, and no enforceRateLimit() call. The only intended throttle is keyed to the caller's own session, so cookie-less requests are never limited. An unauthenticated remote attacker can therefore cause an arbitrary number of verification emails to be sent to any account ID, and can enumerate accounts and their verification status from the three distinct JSON responses ("Verification Sent", "Already verified", "Unknown error"). In addition, createVerificationCode() invokes $user->setRecoverPass() and saves the user, so each anonymous request writes a live password-recovery token onto the targeted account; that token is embedded in base64 in the verification link emailed to the account owner and is accepted by objects/userRecoverPassSave.json.php as the credential for setting a new password.
AVideo LoginControl contains an authentication bypass vulnerability in the PGP second factor verification that compares challenge responses using loose equality against an uninitialized session variable. Attackers with a victim's password can bypass the second factor by sending a parameter-less GET request to verifyChallenge.json.php, which evaluates null == null and marks authentication complete.
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 uses a cryptographically weak pseudo-random number generator when creating account activation / login pairing codes. getRandomCode() in objects/functions.php derives the code entirely from uniqid() (sprintf('%08x%05x', seconds, microseconds)) with a single non-CSPRNG rand() character used only as padding, reducing the code space to roughly 36 x 10^6 (~2^25) values for a known generation second. Because plugin/API/set.json.php?APIName=login_code can be called without authentication, it also serves as an oracle for the server's exact microtime. An unauthenticated remote attacker who guesses a valid, unexpired code (codes expire after 10 minutes) can redeem it at plugin/API/get.json.php?APIName=login_code to obtain the target account's email address and a User::getUserHash(users_id, '+1 year') value, a credential accepted in place of the account password for one year, resulting in account takeover. No patched version is available.
AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 uses cryptographically weak uniqid() values for RTMP publish keys in LiveTransmition, reducing key entropy to approximately one million possibilities per creation second. Attackers who know the channel creation time can brute-force the five-digit microsecond component to forge valid stream keys and broadcast content as the channel owner.
AVideo versions up to and including 29.0 have a missing authorization check in the set_api_comment function. This flaw allows authenticated users to post comments on videos that are password-protected or restricted to certain groups, bypassing intended access controls. Attackers can exploit this by sending POST requests with arbitrary video IDs to the comment API endpoint, enabling them to comment on videos they are not authorized to watch.
AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to validate video access permissions in the API like endpoint, allowing logged-in users to vote on password-protected and group-restricted videos. Attackers can submit like and dislike requests to increment vote counters on videos they cannot watch by calling the set.json.php endpoint with APIName parameters.
AVideo through 29.0 (current revision e01e41ecc) contains a stored cross-site scripting vulnerability. The unauthenticated view-counter endpoint objects/videoAddViewCount.json.php reaches VideoStatistic::save(), which writes the caller's User-Agent (via getUserAgentInfo(), which returns unrecognized agent strings verbatim) directly into the `app` column of the videos_statistics table without invoking the sanitizing setter setApp(); normalizeApp() only truncates the value to 45 characters. The video owner's and administrator's statistics page (view/videoViewsInfo.php) renders this field in a DataTables 1.12.1 column with an unescaped renderer, and DataTables assigns cell content using innerHTML, so attacker-supplied HTML is parsed and executed in the privileged user's authenticated session when the statistics page is viewed. No patched version was available at the time of the advisory.
CVE-2026-92583 is a medium severity vulnerability in WWBN AVideo versions up to and including 29.0. It involves a race condition in the enforceRateLimit() function that allows attackers to bypass login brute-force protections by issuing concurrent authentication requests. This flaw enables attackers to exceed the intended limit of 30 login attempts per 5 minutes by an arbitrary factor based on connection concurrency.
AVideo versions up to 29.0 are vulnerable to a cross-site request forgery (CSRF) flaw in the videoAddNew.json.php endpoint. The vulnerability arises because the automatic CSRF protection and same-domain request checks are disabled when 'user' and 'pass' parameters are present, but these parameters are not validated. An attacker can trick an authenticated user with upload or administrative rights into submitting crafted cross-origin requests that modify video records, including ownership, access restrictions, and other metadata. No patch was available at the time of the advisory.
CVE-2026-92581 is a medium severity vulnerability in WWBN AVideo up to version 29.0 where improper input validation in the Like::__construct() function allows authenticated attackers to manipulate video like counts. By sending array-typed parameters, attackers can cause the like counters to become arbitrarily negative, corrupting the stored vote counts until manually repaired.
In AVideo through 29.0, the CloneSite plugin is vulnerable to stored OS command injection. In plugin/CloneSite/cloneClient.json.php (line ~270) the stored SSH password is substituted into the command string `sshpass -p '{password}' rsync ...` with a plain str_replace and no escaping, so a single quote in the password breaks out of the quoted word and injects arbitrary shell. The password is written through the admin-only endpoint objects/pluginAddDataObject.json.php, whose only CSRF defense (isUntrustedRequest()/forbidIfIsUntrustedRequest()) is a no-op when the request source appears to be loopback — as happens behind a same-host TLS-terminating reverse proxy with $global['trustedProxies'] unset — or when an attacker-controlled application is co-hosted on the same hostname; on HTTPS the session cookie is issued with SameSite=None, so a cross-site POST carries it. An unauthenticated remote attacker can therefore lure an authenticated administrator into planting a malicious password (and an attacker-controlled cloneSiteURL), after which the plugin's documented crontab entry executes the injected command with no further administrator action, as the crontab owner (commonly root or www-data). Exploitation requires the CloneSite plugin to be enabled with the documented crontab installed and one of the above CSRF channels; default single-process Apache deployments are reported as not CSRF-exploitable. This is a residual sink of CVE-2026-41304. The issue is confirmed at master HEAD (8963b6a1); no patched version is available.
In AVideo through 29.0, the autoCSRFGuard() function maintains a hardcoded allowlist of exempt basenames tested without directory context, allowing plugin files matching core filenames to inherit CSRF exemptions. The LoginWordPress plugin file login.json.php inherits an exemption and unconditionally logs out authenticated users on cross-site POST requests before validating credentials.
WWBN AVideo versions up to and including 29.0 contain a critical authentication bypass vulnerability. The flaw allows attackers who have obtained a user's stored password hash to authenticate as that user by submitting the hash directly, bypassing normal password verification. This occurs due to acceptance of the stored hash as a valid credential through two separate code paths in the authentication process.
CVE-2026-92577 is a high-severity authorization bypass vulnerability in WWBN AVideo versions up to 29.0. The flaw exists in the API get_api_video endpoint's clean_title branch, allowing anonymous users to bypass user-group restrictions by querying videos via their public slug. This results in unauthorized disclosure of sensitive user personally identifiable information (PII), including email, phone number, address, birth date, and administrator status.