CVE-2026-34613
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
WWBN AVideo allows admins to enable/disable plugins via objects/pluginSwitch.json.php without CSRF validation and bypassing Referer/Origin checks. An attacker can disable critical security plugins (e.g., 2FA) by luring an admin to a malicious page.
Risk Assessment
An attacker can disable security mechanisms such as two-factor authentication, potentially leading to account takeover or unauthorized access.
Recommendation
No public patches available. Consider temporarily disabling the endpoint or applying additional protections, e.g., custom CSRF validation.
Original NVD description (English source)
WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo endpoint objects/pluginSwitch.json.php allows administrators to enable or disable any installed plugin. The endpoint checks for an active admin session but does not validate a CSRF token. Additionally, the plugins database table is explicitly listed in ignoreTableSecurityCheck(), which means the ORM-level Referer/Origin domain validation in ObjectYPT::save() is also bypassed. Combined with SameSite=None on session cookies, an attacker can disable critical security plugins (such as LoginControl for 2FA, subscription enforcement, or access control plugins) by luring an admin to a malicious page. At time of publication, there are no publicly available patches.