EUVD-2026-281099

fkie_cve-2026-35179

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the SocialMediaPublisher plugin exposes a publishInstagram.json.php endpoint that acts as an unauthenticated proxy to the Facebook/Instagram Graph API. The endpoint accepts user-controlled parameters including an access token, container ID, and Instagram account ID, and passes them directly to the Graph API via InstagramUploader::publishMediaIfIsReady(). This allows any unauthenticated user to make arbitrary Graph API calls through the server, potentially using stolen tokens or abusing the platform's own credentials.

GHSA-x9w5-xccw-5h9w — AVideo: Unauthenticated Instagram Graph API Proxy via publishInstagram.json.php

Affected: Packagist: wwbn/avideo

## Summary

The SocialMediaPublisher plugin exposes a `publishInstagram.json.php` endpoint that acts as an unauthenticated proxy to the Facebook/Instagram Graph API. The endpoint accepts user-controlled parameters including an access token, container ID, and Instagram account ID, and passes them directly to the Graph API via `InstagramUploader::publishMediaIfIsReady()`. This allows any unauthenticated user to make arbitrary Graph API calls through the server, potentially using stolen tokens or abusing the platform's own credentials.

## Details

At `plugin/SocialMediaPublisher/publishInstagram.json.php:14`, the endpoint passes request parameters directly to the Instagram Graph API without any authentication check:

```php InstagramUploader::publishMediaIfIsReady( $_REQUEST['accessToken'], $_REQUEST['containerId'], $_REQUEST['instagramAccountId'] ); ```

There is no call to `User::isLogged()`, `User::isAdmin()`, or any other authorization check before processing the request.

In contrast, sibling endpoints in the same plugin enforce proper authorization: - `uploadVideo.json.php` requires `User::isLogged()` - `refresh.json.php` requires `User::isAdmin()`

The endpoint was confirmed accessible on a live instance: it returns a Graph API error response, demonstrating that it processes the request and forwards it to Facebook's servers.

## Proof of Concept

1. Send a request to the endpoint without any authentication:

```bash curl -s "https://your-avideo-instance.com/…

Most recent entries from all

EUVD-2026-281099

fkie_cve-2026-35179

GHSA-x9w5-xccw-5h9w — AVideo: Unauthenticated Instagram Graph API Proxy via publishInstagram.json.php