PT-2026-7671 · Avideo+2 · Avideo Platform+1

Ihsan Sencan · Published 2026-02-11 · Updated 2026-02-20 · CVE-2020-37158

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AVideo Platform version 8.1

Description The software contains a cross-site request forgery issue that allows attackers to reset user passwords. This is possible by exploiting the password recovery mechanism. Attackers can create malicious requests to the /recoverPass API endpoint using a user's recovery token to change account credentials without needing to authenticate. The vulnerable parameter is the user's recovery token.

Recommendations Apply updates to address the issue in AVideo Platform version 8.1. As a temporary workaround, consider restricting access to the /recoverPass API endpoint to minimize the risk of exploitation.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

CWE-640

Related Identifiers

CVE-2020-37158

Affected Products

Avideo Platform

Avideo

References · 8

• 🔥 https://exploit-db.com/exploits/48003 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-37158 · Security Note
• https://osv.dev/vulnerability/CVE-2020-37158 · Vendor Advisory
• https://github.com/WWBN/AVideo · Note
• https://vulncheck.com/advisories/avideo-platform-cross-site-request-forgery-password-reset · Note
• https://t.me/cveNotify/152412 · Telegram Post
• https://t.me/cveNotify/152597 · Telegram Post
• https://avideo.com · Note