AVideo: Unauthenticated Instagram Graph API Proxy via publishInstagram.json.php
Date: 2026-04
Affected: composer/wwbn/avideo
Attack vector: auth-bypass
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2026-35179
CWE: CWE-862
CVSS: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

## Summary The SocialMediaPublisher plugin exposes a `publishInstagram.json.php` endpoint that acts as an unauthenticated proxy to the Facebook/Instagram Graph API. The endpoint accepts user-controlled parameters including an access token, container ID, and Instagram account ID, and passes them directly to the Graph API via `InstagramUploader::publishMediaIfIsReady()`. This allows any unauthenticated user to make arbitrary Graph API calls through the server, potentially using stolen tokens or abusing the platform's own credentials. ## Details At `plugin/SocialMediaPublisher/publishInstagram.json.php:14`, the endpoint passes request parameters directly to the Instagram Graph API without any authentication check: ```php InstagramUploader::publishMediaIfIsReady( $_REQUEST['accessToken'], $_REQUEST['containerId'], $_REQUEST['instagramAccountId'] ); ``` There is no call to `User::isLogged()`, `User::isAdmin()`, or any other authorization check before processing the request. In contrast, sibling endpoints in the same plugin enforce proper authorization: - `uploadVideo.json.php` requires `User::isLogged()` - `refresh.json.php` requires `User::isAdmin()` The endpoint was confirmed accessible on a live instance: it returns a Graph API error response, demonstrating that it processes the request and forwards it to Facebook's servers. ## Proof of Concept 1. Send a request to the endpoint without any authentication: ```bash curl -s "https://your-avideo-instance.com/p


Mitigations:

Architectural layers (MAESTRO):