Cross-Site Request Forgery Vulnerability in WWBN AVideo Open Source Video Platform

CVE-2026-34613

What is CVE-2026-34613?

WWBN AVideo, an open-source video platform, has a vulnerability in its plugin management feature. Specifically, the endpoint objects/pluginSwitch.json.php allows administrators to enable or disable installed plugins without validating the CSRF token. This omission permits an attacker, who can trick an admin into visiting a malicious page, to disable critical security plugins related to two-factor authentication and access control. Furthermore, the ORM-level security checks are bypassed due to the plugins database table being explicitly excluded from security checks, exacerbating the potential risk. As of the current date, no patches have been publicly released to address this vulnerability.

References