CVE-2026-83595
HIGH
NVD
CVSS Score
8.1
Severity
HIGH
Published
Sep 01, 2026
Vendor
unknown
Description
AVideo contains a cross-site request forgery vulnerability in plugin/API/set.json.php that allows attackers to perform state-changing actions by crafting GET requests that bypass CSRF protection. Attackers can navigate a victim's browser to a malicious URL with API parameters to delete videos, deactivate accounts, or modify playlists without user interaction.