CVE-2026-92581

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 29.1

Description Authenticated attackers can cause a desynchronization between stored votes and counters because the Like:: construct() function performs counter arithmetic on raw request values before they are validated. By sending array-typed like parameters followed by standard requests, an attacker can drive video like counts to arbitrarily negative values. This corruption persists in the denormalized counter, which is a redundant copy of data used to improve read performance, until it is manually repaired.

Recommendations Update to a version later than 29.0. As a temporary mitigation, restrict the ability of users to send array-typed parameters to the like functionality.