CVE-2026-89257: Authorization Bypass Through User-Controlled Key

AVideo through 29.0 contains an insecure direct object reference IDOR vulnerability in objects/categoryDeleteAssets.json.php. The endpoint validates only the Category::canCreateCategory capability and a CSRF nonce before passing the attacker-supplied $REQUEST'id' to Category::deleteAssets, which...

CVE-2026-40928: Cross-Site Request Forgery (CSRF)

WWBN AVideo is an open source video platform. In versions 29.0 and prior, multiple AVideo JSON endpoints under objects/ accept state-changing requests via $REQUEST/$GET and persist changes tied to the caller's session user, without any anti-CSRF token, origin check, or referer check. A malicious...