AVideo has a cross‑site request forgery vulnerability in the setPassword.json.php endpoint. An attacker who can cause an authenticated administrator to visit a malicious webpage can issue a GET request to change or clear any user’s channel password. The flaw allows unauthenticated users to trigger the action without a CSRF token, resulting in credential manipulation.

The affected product is AVideo from WWBN. Specific version information is not provided, but the issue exists in the code before commit c3edcc274c389816d434acadac07ee78eaf330c1 and will affect any installations using earlier versions of the setPassword.json.php handler.

The CVSS score of 7.1 indicates a high impact. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a web‑based CSRF attack; an attacker can craft a malicious webpage that an administrator visits, causing the authenticated session to perform the password change. The vulnerability can be exploited remotely without initial authentication, but it requires the target user to be logged into the application when the malicious page loads.