CVE-2022-27463: 
PHP vulnerability analysis and mitigation

Open redirect vulnerability in objects/login.json.php in WWBN AVideo through 11.6 allows attackers to arbitrarily redirect users from a crafted url to the login page (AttackerKB).

The vulnerability exists in the login.json.php file where insufficient validation of the redirectUri parameter allows attackers to specify arbitrary redirect destinations. The issue was fixed by implementing proper domain validation using isSameDomain() function instead of a simple regex pattern match (GitHub).

This vulnerability could be exploited to conduct phishing attacks by redirecting users from a legitimate AVideo platform URL to malicious websites, potentially leading to credential theft or other social engineering attacks.

The vulnerability has been patched by implementing proper domain validation in the login.json.php file. Users should upgrade to a version after 11.6 that includes this security fix (GitHub).