The AVideo application (versions up to 29.0) contains a public write endpoint that allows callers to specify an arbitrary recipient address. When the optional "contactForm" parameter is omitted, the script sends email via the site’s SMTP server with the configurable contact email as the From:/Reply‑To address. Because the endpoint is fully public, an attacker can craft arbitrary messages and redirect them to targeted recipients. The messages are signed with the site’s domain (SPF/DKIM/DMARC), making them appear legitimate and facilitating phishing or brand impersonation attacks.

The vulnerability impacts the open‑source video platform WWBN AVideo, specifically installations on or before version 29.0. Newer releases, as identified by commit 4e3709895857a5857f0edb46b0ee984de0d9e1a2, contain a patch that removes or protects the vulnerable endpoint.

The CVSS score of 5.3 indicates a moderate severity. Exploitation requires no authentication; the attacker still has to solve a captcha, but the endpoint does not require a CSRF token or further privileges. EPSS data is not available, and the vulnerability is not yet listed in CISA’s KEV catalog. An attacker with network access to the web server can directly invoke the endpoint and direct the site’s SMTP infrastructure to send attacker‑crafted emails to arbitrary recipients using the site’s authentic address.