CyberRota Analysis
AI-GeneratedThe SocialMediaPublisher plugin in AVideo has a missing authorization vulnerability that allows authenticated users to manipulate other users' OAuth token records via the add.json.php endpoint. This can lead to unauthorized access, enabling attackers to overwrite access and refresh tokens, potentially severing victims' connections to their social media accounts. Organizations using AVideo should prioritize patching this vulnerability to protect user data and prevent account takeovers.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in the SocialMediaPublisher plugin's add.json.php endpoint that allows authenticated users to modify other users' OAuth token records. Attackers can supply arbitrary row IDs to overwrite another user's stored access_token and refresh_token, then delete the compromised record to destroy the victim's provider linkage.