In AVideo versions 26.0 and earlier, an endpoint that lets administrators send HTML emails to all users lacks CSRF protection. This allows an attacker to compel an admin to visit a malicious page and automatically submit a request that is authenticated with the admin’s session cookie. The result is a spoofed mass email that appears to come from the platform’s legitimate SMTP address, enabling large‑scale phishing attacks. The vulnerability does not give code execution or direct data access, but it undermines user trust and can lead to credential theft or further compromise through social engineering.

The affected product is WWBN AVideo, specifically the emailAllUsers.json.php endpoint available in all releases up to and including version 26.0. Any installation of AVideo 26.0 or older that has not applied a newer fix is vulnerable.

The CVSS score of 6.5 indicates a medium to high severity, while the EPSS score of less than 1% suggests that exploitation has not been widely observed. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is cross‑site request forgery; an attacker must lure an administrator to a malicious site that can trigger a POST request to the endpoint. Once an admin is compromised, the attacker can send arbitrary phishing emails to every user, potentially leading to credential compromise or malware delivery. Because the platform stores the admin session cookie with SameSite=None, the cookie is sent automatically by the browser, making the exploit trivial for anyone who can gain the admin’s attention.