The vulnerability is a cross‑site request forgery (CWE‑352) in WWBN AVideo's videoEditLight.php script. It accepts GET requests and has no request authenticity checks, allowing an attacker to embed an img tag in a video description that, when an administrator views the page, transfers ownership of the video to an attacker‑controlled account. The exploit results in unauthorized ownership and control of content.

The affected product is WWBN AVideo, all versions prior to commit 9c39d8c8. No specific patch version is listed; the advisory references older code. Update to a version that removes the GET handling or adds CSRF validation.

The CVSS score of 6.9 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a crafted GET request delivered through a malicious image tag that an administrator unwittingly loads while viewing the video. Successful exploitation requires only that the administrator authenticate and view the page; the attacker does not need elevated privileges to change ownership, making it a practical threat for compromised admin sessions.