Cross-Site Request Forgery in AVideo API Plugin

AVideo contains a cross-site request forgery vulnerability in plugin/API/set.json.php that allows attackers to perform state-changing actions by crafting GET requests that bypass CSRF protection. Attackers can navigate a victim's browser to a malicious URL with API parameters to delete videos, deactivate accounts, or modify playlists without user interaction.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

AVideo's plugin/API/set.json.php endpoint contains a cross-site request forgery (CSRF) vulnerability that permits attackers to execute unauthorized state-changing operations through specially crafted GET requests. This vulnerability bypasses CSRF protections, enabling adversaries to manipulate victims' browsers into performing destructive actions—including video deletion, account deactivation, and playlist modification—without explicit user consent. Organizations deploying AVideo for media management, content delivery, or collaborative platforms face direct risk of data loss and account compromise. The vulnerability affects any user authenticated to an AVideo instance who visits a malicious webpage, making it a persistent threat across diverse deployment scenarios.

Casky's security skills leverage Claude's extended reasoning to map this vulnerability against MITRE ATT&CK techniques TA0001 (Reconnaissance) and TA0043 (Reconnaissance). Practitioners using Casky will identify attack chains where adversaries first gather intelligence on AVideo installations and authenticated user sessions, then craft malicious URLs embedding API parameters that exploit the missing CSRF token validation. The platform's 323 matched skills enable detection of reconnaissance activities probing for vulnerable instances, social engineering attempts to lure authenticated users to malicious domains, and anomalous API requests containing unexpected state-change parameters. Security teams will surface findings highlighting suspicious GET requests to set.json.php, cross-domain referrer patterns inconsistent with legitimate workflows, and bulk modifications to accounts or content repositories—enabling rapid response before destructive actions succeed.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-83595.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-83595

Casky has 323 skills that investigate the attack patterns behind CVE-2026-83595. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn