A legacy endpoint in WWBN AVideo, objects/userSavePhoto.php, accepts a base64‑encoded POST payload and writes the decoded bytes directly to a user‑specific PNG file. Only a logged‑in check is performed; no CSRF token, no origin verification, and no MIME validation. Because the platform's default cookie policy is SameSite=None; Secure, an attacker can lure a logged‑in user to a malicious web page that issues an authenticated POST request, causing the service to overwrite the target's profile photo and trigger a global cache clear. The CVSS v3.1 score of 5.4 classifies the flaw as medium severity, allowing an attacker to alter user asset integrity and potentially disrupt service availability through repeated cache invalidations.

Versions of WWBN AVideo up to and including 29.0 contain the vulnerable endpoint. The vendor provided a fix in commit 9c38468041505e637101c5943c5370c68f48e3ac, which is incorporated in releases 29.1 and later. The newer releases disable the public CSRF‑vulnerable path and strengthen the CSRF filter for the profile‑photo upload.

The likely attack vector is a cross‑origin HTTP POST from a malicious page that admins or users visit while their session cookie is transmitted due to the SameSite=None setting. No additional conditions are required beyond a regular authenticated session. The vulnerability is not listed in CISA KEV, and no EPSS score is available, so the exact exploitation probability cannot be quantified. Given the public availability of the forked software and the lack of needed prerequisites, the risk is considered moderate but manageable by applying the vendor‑issued fix.