PT-2026-30285 · Avideo · Avideo

Adrgs

·

Published

2026-04-03

·

Updated

2026-04-06

·

CVE-2026-35181

CVSS v3.1

4.3

Medium

VectorAV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Name of the Vulnerable Software and Affected Versions AVideo versions 26.0 and prior
Description The player skin configuration endpoint at /admin/playerUpdate.json.php does not validate CSRF tokens. The plugins table is explicitly excluded from the ORM's domain-based security check via ignoreTableSecurityCheck(), removing a layer of defense. Combined with SameSite=None cookies, a cross-origin POST can modify the video player appearance on the entire platform. The vulnerability lies in directly setting the player skin from POST data at line 17 of admin/playerUpdate.json.php using $pluginDO->skin = $ POST['skin']; without any CSRF validation. The ignoreTableSecurityCheck() function bypasses the ORM-level protection for plugin configuration. AVideo's session cookies are configured with SameSite=None, allowing the admin's authenticated session cookie to be included in cross-origin POST requests.
Recommendations Add CSRF token validation at /admin/playerUpdate.json.php, before processing POST data:
php
// admin/playerUpdate.json.php (before line 17)
if (!isGlobalTokenValid()) {
  die('{"error":"Invalid CSRF token"}');
}

Exploit

Fix

CSRF

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-35181
GHSA-4Q27-4RRQ-FX95

Affected Products

Avideo