The vulnerability resides in the objects/commentDelete.json.php endpoint and allows an authenticated user with comment deletion privilege to have comments removed by an attacker who tricks them into visiting a malicious page. The endpoint performs no CSRF validation, ignoring tokens, Origin, and Referer. Because the platform sets session.cookie_samesite=None, any cross‑site request silently supplies the victim’s session cookie. An attacker can therefore delete comments en masse, undermining content integrity and potentially author reputation. The weakness aligns with CWE‑352 "Cross‑Site Request Forgery".

Affects the open‑source video platform WWBN AVideo versions 29.0 and earlier. The fix is included in commit 184f36b1896f3364f864f17c1acca3dd8df3af27, so any deployment using a pre‑29.0 release is vulnerable.

The vulnerability has a CVSS score of 5.4, indicating medium severity. EPSS is not available, so exploit likelihood cannot be quantified precisely, but the absence of CSRF checks and the platform’s cookie settings make the attack straightforward. The vulnerability is not listed in CISA KEV, so it has not yet been observed in the wild. Attackers would need only a malicious web page and an authenticated user with delete rights; thus the attack vector is cross‑site request forgery, which is commonly feasible in a modern browser environment.