A missing authorization check in AVideo's SocialMediaPublisher add.json.php lets an authenticated user supply any database row ID and overwrite another user's access_token and refresh_token. The attacker can then delete that record to remove the victim’s social media provider linkage. This grants the attacker the ability to hijack or disrupt the victim’s social media integration, potentially exposing personal data or denying service to the victim. The weakness is classified as CWE-639, unauthorized delegation.

The vulnerable component is the SocialMediaPublisher plugin for WWBN AVideo. The patch is present in the commit c3edcc274c389816d434acadac07ee78eaf330c1; specific version ranges are not listed. Users running this commit or earlier versions of the plugin are affected.

The CVSS score of 7.1 indicates a high severity of vulnerability. EPSS is not available, so current exploitation likelihood is unknown. The issue is not listed in CISA KEV. Attackers would likely trigger the flaw via HTTP requests to the add.json.php endpoint, which requires authentication, so the attack vector is inferred as web-based. Given the potential for token hijacking and social media linkage destruction, the risk to compromised accounts is significant.