https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-19T10:54:41.180302+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-281099 EUVD-2026-281099 2026-10-19T10:54:41.183491+00:00 EUVD-2026-281099 https://cve.radiocsirt.org/vuln/fkie_cve-2026-35179 fkie_cve-2026-35179 2026-10-19T10:54:41.183539+00:00

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the SocialMediaPublisher plugin exposes a publishInstagram.json.php endpoint that acts as an unauthenticated proxy to the Facebook/Instagram Graph API. The endpoint accepts user-controlled parameters including an access token, container ID, and Instagram account ID, and passes them directly to the Graph API via InstagramUploader::publishMediaIfIsReady(). This allows any unauthenticated user to make arbitrary Graph API calls through the server, potentially using stolen tokens or abusing the platform's own credentials.

 https://cve.radiocsirt.org/vuln/ghsa-x9w5-xccw-5h9w GHSA-x9w5-xccw-5h9w — AVideo: Unauthenticated Instagram Graph API Proxy via publishInstagram.json.php 2026-10-19T10:54:41.183591+00:00

Affected: Packagist: wwbn/avideo

## Summary

The SocialMediaPublisher plugin exposes a `publishInstagram.json.php` endpoint that acts as an unauthenticated proxy to the Facebook/Instagram Graph API. The endpoint accepts user-controlled parameters including an access token, container ID, and Instagram account ID, and passes them directly to the Graph API via `InstagramUploader::publishMediaIfIsReady()`. This allows any unauthenticated user to make arbitrary Graph API calls through the server, potentially using stolen tokens or abusing the platform's own credentials.

## Details

At `plugin/SocialMediaPublisher/publishInstagram.json.php:14`, the endpoint passes request parameters directly to the Instagram Graph API without any authentication check:

```php InstagramUploader::publishMediaIfIsReady( $_REQUEST['accessToken'], $_REQUEST['containerId'], $_REQUEST['instagramAccountId'] ); ```

There is no call to `User::isLogged()`, `User::isAdmin()`, or any other authorization check before processing the request.

In contrast, sibling endpoints in the same plugin enforce proper authorization: - `uploadVideo.json.php` requires `User::isLogged()` - `refresh.json.php` requires `User::isAdmin()`

The endpoint was confirmed accessible on a live instance: it returns a Graph API error response, demonstrating that it processes the request and forwards it to Facebook's servers.

## Proof of Concept

1. Send a request to the endpoint without any authentication:

```bash curl -s "https://your-avideo-instance.com/…