AVideo: Unauthenticated Arbitrary Email Sending via sendEmail.json.php Enables Phishing from the Site’s Legitimate From Address
Date: 2026-05
Affected: composer/wwbn/avideo
Attack vector: deepfake
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2026-43880
CWE: CWE-940
CVSS: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

## Summary `objects/sendEmail.json.php` exposes two branches depending on whether `contactForm=1` is submitted. When the parameter is omitted, the endpoint sets `$sendTo` to an attacker-supplied email and, for unauthenticated callers, uses the site's own contact email as the message `From:`/`Reply-To:`. The endpoint is explicitly allow-listed as a "public write action" in `objects/functionsSecurity.php` (line 885), so it requires no authentication or CSRF token. An unauthenticated attacker (solving a captcha) can force the site's own SMTP infrastructure to send attacker-composed emails to arbitrary recipients with the site's legitimate sender address, passing SPF/DKIM/DMARC for the site's domain — ideal for targeted phishing and brand impersonation. ## Details **Vulnerable code (`objects/sendEmail.json.php`):** ```php 10: $valid = Captcha::validation(@$_POST['captcha']); 11: if(User::isAdmin()){ 12: $valid = true; 13: } ... 16: if ($valid) { ... 24: $mail = new \PHPMailer\PHPMailer\PHPMailer(); 25: setSiteSendMessage($mail); // uses site's SMTP credentials ... 30: $replyTo = User::getEmail_(); 31: if (empty($replyTo)) { 32: $replyTo = $config->getContactEmail(); // <-- FALLBACK to site's own email 33: } 34: 35: $sendTo = $_POST['email']; // attacker-controlled recipient 36: 37: // if it is from contact form send the message to the siteowner and the sender is the email on the form field 38: if (!empty($_POS


Mitigations:

Architectural layers (MAESTRO):