CVE-2026-89148 Details
Description
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an open redirect in objects/playlistSort.php. Because the endpoint is not a *.json.php script, AVideo's automatic CSRF guard (autoCSRFGuard()/forbidIfIsUntrustedRequest()) does not run, and when the request includes the sort parameter the script issues a Location header set to the unvalidated $_SERVER['HTTP_REFERER'] value without calling isSafeRedirectURL(). A remote unauthenticated attacker can therefore induce a logged-in user who can manage the targeted playlist to submit a cross-origin POST with a crafted Referer, causing the victim's playlist to be reordered and the victim's browser to be redirected from a trusted AVideo URL to an attacker-controlled site for phishing. No patched version is available.
An open redirect vulnerability has been identified in AVideo versions through commit c3edcc274c389816d434acadac07ee78eaf330c1. The issue resides in the 'objects/playlistSort.php' file, where the automatic Cross-Site Request Forgery (CSRF) protection is bypassed. This occurs because the endpoint does not use the '.json.php' extension, preventing the CSRF guard from activating. When the 'sort' parameter is included in the request, the script redirects to the unvalidated 'HTTP_REFERER' value without proper validation. As a result, a remote, unauthenticated attacker can manipulate a logged-in user with playlist management privileges to reorder a playlist and redirect the user's browser to a phishing site, all while exploiting a trusted AVideo URL.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 11, 2026CISA-ADP
Assessed Sep 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/WWBN/AVideo/security/advisories/GHSA-jj4v-c999-cm2m | CISA-ADP | AdvisoryExploitVendor |
| https://github.com/WWBN/AVideo/security/advisories/GHSA-jj4v-c999-cm2m | [email protected] | AdvisoryExploitVendor |
| https://www.vulncheck.com/advisories/avideo-open-redirect-via-playlistsort-php-referer-header | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-352 | Cross-Site Request Forgery (CSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| WWBN/AVideo | <= c3edcc274c389816d434acadac07ee78eaf330c1 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 11, 2026 | CVE Modified | CISA-ADP |
| Sep 11, 2026 | New CVE Received | [email protected] |