Cross-Site Request Forgery Vulnerability in AVideo by WWBN
CVE-2026-40925

8.3HIGH

Key Information:

Vendor

Wwbn

Status
Avideo
Vendor
CVE Published:
21 April 2026

What is CVE-2026-40925?

AVideo, an open-source video platform provided by WWBN, has a vulnerability found in version 29.0 and earlier that exposes critical site settings to unauthorized alterations. The flaw resides in the objects/configurationUpdate.json.php file, where several global site settings, including SMTP credentials and site encoders, can be modified via a cross-origin request. This happens because the endpoint's security relies solely on User::isAdmin() without proper validation of the request origin, globalToken, or other crucial security checks. Moreover, AVideo's configuration permits cross-origin iframe embedding by setting session.cookie_samesite=None. Consequently, when an authenticated administrator visits a malicious page, the browser can unwittingly send a POST request allowing attackers to rewrite sensitive configuration settings. A fix for this vulnerability has been implemented in commit f9492f5e6123dff0292d5bb3164fde7665dc36b4.

Affected Version(s)

AVideo <= 29.0

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-v...
x_refsource_CONFIRM
https://github.com/WWBN/AVideo/commit/f9492f5e6123dff0292...
x_refsource_MISC

CVSS V3.1

Score:
8.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.