Cross-Site Request Forgery in WWBN AVideo Video Platform

CVE-2026-34611

What is CVE-2026-34611?

WWBN AVideo, an open source video platform, contains a vulnerability in its email sending functionality. Specifically, the endpoint for sending email notifications to users does not properly validate CSRF tokens. This flaw allows an attacker to craft a malicious page that, when visited by an admin user, triggers an unauthorized email to all registered users containing arbitrary HTML content. The vulnerability stems from the use of SameSite=None on session cookies, which results in automatic inclusion of the admin's session cookie in cross-origin requests. Consequently, the attacker can leverage this vulnerability to send deceptive emails that seem credible, as they appear to come from the legitimate SMTP address of the AVideo instance. As of now, there are no patches available to address this issue.

References