WWBN AVideo in versions 29.0 and earlier exposes several JSON endpoints that accept state‑changing requests using unfiltered GET or REQUEST parameters. These endpoints allow a logged‑in user’s session to perform actions such as liking or disliking comments, posting new comments on behalf of the user, and deleting assets from categories where the user has management rights. Because no anti‑CSRF token, origin, or referer validation is performed, a malicious site can force the victim’s browser to send these requests silently. This is a Cross‑Site Request Forgery (CWE-352) flaw, so the likely attack vector is a CSRF exploit when a victim visits an attacker‑controlled page that includes an image or form targeting one of the vulnerable URLs, causing the victim’s credentials to be used without consent.

The vulnerability affects the open‑source video platform WWBN AVideo up to and including version 29.0. The affected endpoints are located under the objects/ directory and include objects/comments_like.json.php, objects/commentAddNew.json.php, and objects/categoryDeleteAssets.json.php. No other vendors or products were listed.

The CVSS score of 5.4 indicates a moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited publicly known exploitation at this time. Successful exploitation requires the victim to be authenticated within the application and simply load an attacker‑controlled page. Once triggered, the attacker can manipulate the victim’s likes/dislikes, inject comments, or delete category assets, compromising data integrity and potentially causing unwanted user interactions or resource removal.