Cross-Site Request Forgery Vulnerability in WWBN AVideo Admin Interfaces

CVE-2026-40926

What is CVE-2026-40926?

A significant vulnerability exists in the WWBN AVideo platform, where certain admin-only JSON endpoints fail to implement necessary security measures. Versions 29.0 and earlier are affected, allowing an attacker to exploit the role-check mechanism to execute unauthorized actions such as creating, deleting, or updating categories, and to execute any installed plugin's update scripts. This risk arises because these endpoints do not verify CSRF tokens, which should have been a mandatory step to mitigate potential exploits. An attacker can lure an authenticated admin to a malicious page, causing severe alterations to the platform's database and functionality. A security fix has been implemented in the latest updates.

References