CVE-2026-35179: 
PHP vulnerability analysis and mitigation

CVE-2026-35179 is a Missing Authorization vulnerability in the SocialMediaPublisher plugin of WWBN AVideo that exposes an unauthenticated proxy endpoint to the Facebook/Instagram Graph API. The vulnerability affects AVideo versions up to and including 26.0 (composer package wwbn/avideo). It was published on April 1, 2026, by DanielnetoDotCom and added to the GitHub Advisory Database on April 3, 2026. The CVSS v3.1 base score is 5.3 (Medium) (GitHub Advisory, AVideo Advisory).

The root cause is CWE-862 (Missing Authorization): the file plugin/SocialMediaPublisher/publishInstagram.json.php at line 14 passes user-supplied request parameters (accessToken, containerId, instagramAccountId) directly to InstagramUploader::publishMediaIfIsReady() without any call to User::isLogged(), User::isAdmin(), or any other authorization check. In contrast, sibling endpoints in the same plugin (uploadVideo.json.php and refresh.json.php) enforce proper authentication. An attacker can exploit this by sending an unauthenticated HTTP POST request to the endpoint with arbitrary or stolen Graph API credentials, causing the AVideo server to forward the request to Facebook's infrastructure. The advisory was discovered by aisafe.io and a concrete proof-of-concept curl command is publicly available (AVideo Advisory).

Successful exploitation allows any unauthenticated network attacker to use the AVideo server as a proxy for arbitrary Instagram/Facebook Graph API calls, with the server's IP address appearing as the originator. When combined with a companion vulnerability (AVI-027) that exposes stored social media API credentials, an attacker could publish, modify, or delete content on the platform's Instagram account without any authentication to AVideo. Additionally, the proxy behavior could be abused to bypass IP-based rate limits or restrictions enforced by the Graph API, with no confidentiality or availability impact but a low integrity impact (GitHub Advisory).

A proof-of-concept exploit consisting of concrete curl commands is publicly available in the GitHub security advisory, demonstrating how to trigger the unauthenticated proxy with high confidence (AVideo Advisory). The EPSS score is approximately 0.097% (27th percentile), indicating a low but non-negligible probability of exploitation in the near term. There is no evidence of active in-the-wild exploitation or threat actor attribution at this time, and the vulnerability is not listed in the CISA KEV catalog (GitHub Advisory).

1. Reconnaissance: Identify internet-facing AVideo instances running version 26.0 or earlier using search engines (e.g., Shodan, Censys) or by checking the AVideo version endpoint. Confirm the SocialMediaPublisher plugin is installed by probing plugin/SocialMediaPublisher/publishInstagram.json.php.
2. Probe the endpoint: Send an unauthenticated HTTP POST request with dummy parameters to confirm the endpoint is active and forwarding requests to Facebook's Graph API:

curl -s "https://your-avideo-instance.com/plugin/SocialMediaPublisher/publishInstagram.json.php" \
  -d "accessToken=TEST_TOKEN&containerId=TEST_CONTAINER&instagramAccountId=TEST_ACCOUNT"

A Graph API error response (e.g., {"error":{"message":"Invalid OAuth access token.","type":"OAuthException","code":190}}) confirms the endpoint is functional. 3. Obtain valid credentials: Leverage a companion vulnerability (AVI-027) or other means to obtain a valid Instagram access token, container ID, and Instagram account ID stored or used by the AVideo instance. 4. Publish/modify Instagram content: Submit a crafted POST request with the valid credentials to publish or manipulate content on the target's Instagram account:

curl -s "https://your-avideo-instance.com/plugin/SocialMediaPublisher/publishInstagram.json.php" \
  -d "accessToken=LEAKED_ACCESS_TOKEN&containerId=REAL_CONTAINER_ID&instagramAccountId=REAL_ACCOUNT_ID"

5. Abuse as API proxy: Optionally, use the server as a proxy for additional Graph API calls to bypass IP-based rate limits or restrictions (AVideo Advisory).

• Network: Unusual or repeated HTTP POST requests to /plugin/SocialMediaPublisher/publishInstagram.json.php from unauthenticated or unknown source IPs; outbound connections from the AVideo server to graph.facebook.com or graph.instagram.com not initiated by legitimate admin activity.
• Logs: Web server access logs showing POST requests to publishInstagram.json.php without a valid session cookie or authentication header; Graph API error responses (HTTP 200 with JSON error body) logged in application output.
• File System: No specific file artifacts expected from this vulnerability alone, but review for any newly created or modified files in plugin/SocialMediaPublisher/ that may indicate tampering.
• Application Behavior: Unexpected Instagram posts, content modifications, or deletions on the platform's connected Instagram account; Graph API rate limit warnings or IP blocks affecting the AVideo server's outbound requests (AVideo Advisory).

No patched version has been officially released as of the advisory publication date; all AVideo versions up to and including 26.0 are affected. The recommended fix is to add an admin authorization check at the top of plugin/SocialMediaPublisher/publishInstagram.json.php (line 10): if(!User::isAdmin()){ die(json_encode(['error'=>'Not authorized'])); }. As an immediate workaround, administrators should disable the SocialMediaPublisher plugin if not in use, restrict access to the endpoint via web server configuration (e.g., deny external access to publishInstagram.json.php), and review and revoke any exposed Instagram API credentials. Monitor Instagram account activity for unauthorized changes (AVideo Advisory).