Cross-Site Request Forgery Vulnerability in WWBN AVideo
CVE-2026-81733

5.1MEDIUM

Key Information:

Vendor

Wwbn

Status
Avideo
Vendor
CVE Published:
28 August 2026

What is CVE-2026-81733?

WWBN AVideo software versions up to 30.0 include a cross-site request forgery vulnerability that can be exploited via the plugin/Live/myLiveControls.save.json.php endpoint. This endpoint inadequately validates requests by only confirming user authentication while neglecting the enforcement of CSRF tokens or origin checks. An attacker can potentially lure a signed-in streamer to a malicious web page, enabling them to clandestinely alter critical live-channel viewer-redirect settings. These settings, stored in users.externalOptions, can lead viewers to phishing websites or display deceptive messages.

Affected Version(s)

AVideo 0 <= 30.0

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-w...
vendor-advisory
https://www.vulncheck.com/advisories/wwbn-avideo-through-...
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

skeletonsec
.