CVE-2026-89257

AVideo through 29.0 contains an insecure direct object reference IDOR vulnerability in objects/categoryDeleteAssets.json.php. The endpoint validates only the Category::canCreateCategory capability and a CSRF nonce before passing the attacker-supplied $REQUEST'id' to Category::deleteAssets, which...

CVE-2026-89257: Authorization Bypass Through User-Controlled Key

AVideo through 29.0 contains an insecure direct object reference IDOR vulnerability in objects/categoryDeleteAssets.json.php. The endpoint validates only the Category::canCreateCategory capability and a CSRF nonce before passing the attacker-supplied $REQUEST'id' to Category::deleteAssets, which...

CVE-2026-40928

WWBN AVideo is an open source video platform. In versions 29.0 and prior, multiple AVideo JSON endpoints under "objects/" accept state-changing requests via "$REQUEST"/"$GET" and persist changes tied to the caller's session user, without any anti-CSRF token, origin check, or referer check. A...

CVE-2026-40928: Cross-Site Request Forgery (CSRF)

WWBN AVideo is an open source video platform. In versions 29.0 and prior, multiple AVideo JSON endpoints under objects/ accept state-changing requests via $REQUEST/$GET and persist changes tied to the caller's session user, without any anti-CSRF token, origin check, or referer check. A malicious...

PT-2026-35128

Summary Multiple AVideo JSON endpoints under objects/ accept state-changing requests via $ REQUEST/$ GET and persist changes tied to the caller's session user, without any anti-CSRF token, origin check, or referer check. A malicious page visited by a logged-in victim can silently: 1. Cast/flip th...