GHSA-27wf-8499-p469

The endpoint plugin/YPTWallet/view/saveConfiguration.php lets a logged-in user save their wallet configuration, including the cryptocurrency payout address and the donation notification (webhook) URL, but it has no Cross-Site Request Forgery protection. It is authenticated only by the ambient session via User::isLogged(). Because it is a plain .php file, it falls outside the scope of AVideo's centralized auto-CSRF guard, which only runs for *.json.php requests, and it adds no explicit per-endpoint check. On production HTTPS deployments, session cookies are set with SameSite=None, so an attacker who lures a logged-in user to a web page can submit a cross-origin POST that overwrites the victim's crypto wallet address (redirecting future payouts to the attacker) and the victim's donation notification URL.

The endpoint performs a state-changing write under ambient session authentication without verifying that the request was intentionally issued by the user.