The vulnerability is a classic cross‑site request forgery flaw in the AVideo 2FA toggle endpoint. The endpoint accepts a POST request with set2FA set to false and executes the toggle without any CSRF token validation, SameSite cookie enforcement, or re‑authentication. As a result, an attacker can craft a malicious page that a logged‑in user visits, and without the user’s knowledge the attacker flips the victim’s two‑factor authentication off. This removes a layer of account security and could allow the attacker to subsequently take over that account. The weakness maps to CWE‑306 (Missing Authentication for Sensitive Function) and CWE‑352 (Cross‑Site Request Forgery).

The flaw exists in the WWBN AVideo plugin for the LoginControl module on version 29.0 and earlier. Any installation of AVideo that has not applied the vendor‑released patch or upgraded to a version that includes CSRF protection for the set.json.php endpoint is affected.

With a CVSS score of 5.7 the risk is moderate, but because the attack vector is simple web traffic that occurs when a user is logged in, the exploit probability could be non‑negligible. No EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog, yet attackers can leverage it by hosting any malicious page that triggers the hidden form or fetch request. The vulnerability is exploitable only when the user is authenticated to the AVideo admin interface and the victim’s browser accepts cross‑origin requests without SameSite protection.