Cross-Site Request Forgery Vulnerability in AVideo by WWBN
CVE-2026-40929

5.4MEDIUM

Key Information:

Vendor

Wwbn

Status
Avideo
Vendor
CVE Published:
21 April 2026

What is CVE-2026-40929?

AVideo, an open-source video platform developed by WWBN, has a concerning flaw affecting versions 29.0 and earlier. The vulnerability arises from the objects/commentDelete.json.php endpoint, which fails to validate CSRF tokens, thereby exposing the platform to potential abuse. Attackers can exploit this weakness by tricking authenticated users—such as moderators or video owners—into visiting a malicious webpage that can delete comments on their behalf. This occurs without proper checks on Origin or Referer, largely due to the platform's setting of session.cookie_samesite=None to support cross-origin requests. A fix for this vulnerability has been implemented in commit 184f36b1896f3364f864f17c1acca3dd8df3af27.

Affected Version(s)

AVideo <= 29.0

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-8...
x_refsource_CONFIRM
https://github.com/WWBN/AVideo/commit/184f36b1896f3364f86...
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.