AVideo contains a cross-site request forgery vulnerability in plugin/API/set.json.php that allows attackers to perform state-changing actions by crafting GET requests that bypass CSRF protection. Attackers can navigate a victim's browser to a malicious URL with API parameters to delete videos, deactivate accounts, or modify playlists without user interaction.

AVideo contains a cross-site request forgery (CSRF) vulnerability in the plugin/API/set.json.php endpoint. The flaw allows attackers to craft malicious GET requests that bypass CSRF protections and perform unauthorized state-changing actions. By navigating a victim's browser to a specially crafted URL, attackers can delete videos, deactivate user accounts, or modify playlists without any user interaction. The vulnerability stems from the API accepting GET requests for operations that should require authenticated POST requests with CSRF tokens. This represents a significant risk to AVideo deployments as exploitation requires only that a logged-in user visit a malicious URL. The vulnerability is tracked as CVE-2026-83595 and has been documented in both the GitHub security advisories and VulnCheck advisories.