Cross-Site Request Forgery Vulnerability in AVideo Open Source Platform

CVE-2026-45610

What is CVE-2026-45610?

AVideo, an open-source video platform, has a vulnerability that allows an attacker to exploit cross-site request forgery on the 2FA toggle functionality. In versions 29.0 and earlier, the plugin/loginControl/set.json.php endpoint permits certain POST requests without validating the origin, enabling unauthorized changes to user settings. Specifically, an attacker can remotely disable two-factor authentication for a logged-in user through a crafted cross-origin request. This occurs due to the lack of security checks like token validation and re-authentication, raising significant concerns for user account protection.

References