CVE-2026-40928
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
AVideo versions 29.0 and prior contain multiple JSON endpoints under objects/ that accept state-changing requests via $_REQUEST/$_GET and persist changes tied to the caller's session user, without any anti-CSRF token, origin check, or referer check. A malicious page visited by a logged-in victim can silently cast/flip the victim's like/dislike on a comment, post a comment authored by the victim on any video, and/or delete assets from any category.
Risk Assessment
An attacker can perform actions on behalf of a logged-in user (CSRF), leading to unauthorized content modifications and potential data loss. Exploitation only requires the victim to load an attacker-controlled HTML resource.
Recommendation
Update AVideo to a version containing commit 7aaad601bd9cd7b993ba0ee1b1bea6c32ee7b77c. Until patched, consider implementing additional CSRF protections at the reverse proxy level.
Other vulnerabilities in AVideo
See all- CVE-2026-89255High
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LoginControl plugin that fails to HTML-encode PGP public keys echoed into a textarea element. An authenticated attacker can inject malicious JavaScript by submitting a crafted public key, which executes in an administrator's session when viewing the user's profile tab.
- CVE-2026-89253High
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the user 'donationLink' profile field. User::setDonationLink() stores the value and save() validates it only with filter_var(..., FILTER_VALIDATE_URL), which accepts strings such as http://evil.example/"onmouseover=alert(document.domain)//, while getDonationLink() applies only strip_tags() and does not encode double quotes. An authenticated user who updates their own profile can break out of the href attribute and inject an event handler that executes JavaScript in the browser of any visitor, including an administrator.
- CVE-2026-89250High
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an unauthenticated file read vulnerability in the getRecordedFile.php endpoint that streams recorded FLV files from the temporary directory. Attackers can request the endpoint with a known or guessed stream key to download recorded live video files without authentication or authorization checks.
- CVE-2026-89248Medium
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 is missing an authentication/authorization check in plugin/WebRTC/status.json.php. When the WebRTC plugin is present, any unauthenticated remote user can request the endpoint and receive JSON containing the absolute filesystem path of the WebRTC2RTMP helper binary, the configured WebRTC port, file_exists/is_executable status, log contents, and port reachability information.
- CVE-2026-89245Medium
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in playlistRemove.php that allows attackers to delete playlists by skipping CSRF protection checks. Attackers can craft a malicious form that submits a POST request to playlistRemove.php.
- CVE-2026-89240Medium
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Live/confirmLivePassword.php. The unauthenticated GET parameter u is interpolated directly into an img src attribute without URL- or HTML-encoding, allowing injection of an additional tag with an onerror handler.
- CVE-2026-89148Medium
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an open redirect in objects/playlistSort.php. Because the endpoint is not a *.json.php script, AVideo's automatic CSRF guard (autoCSRFGuard()/forbidIfIsUntrustedRequest()) does not run, and when the request includes the sort parameter the script issues a Location header set to the unvalidated $_SERVER['HTTP_REFERER'] value without calling isSafeRedirectURL(). A remote unauthenticated attacker can therefore induce a logged-in user who can manage the targeted playlist to submit a cross-origin POST with a crafted Referer, causing the victim's playlist to be reordered and the victim's browser to be redirected from a trusted AVideo URL to an attacker-controlled site for phishing. No patched version is available.
- CVE-2026-88874High
AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 does not enforce the Live stream password check on the stats endpoint or on the HLS origin. Live::_getStats() returns a password-protected transmission's RTMP stream key, isPasswordProtected flag, and HLS URL to unauthenticated callers, and the shipped NGINX configuration serves the .m3u8 playlist, AES-128 key, and transport-stream segments without authentication.
- CVE-2026-88873High
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in view/logArchive.json.php. Unauthenticated attackers can archive application logs via GET requests without CSRF token validation, copying sensitive logs to a publicly accessible zip file and truncating the live log.
- CVE-2026-88872High
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in the setPassword.json.php endpoint. Unauthenticated attackers can modify any user's channel password by sending a GET request without CSRF token validation.
Original NVD description (English source)
WWBN AVideo is an open source video platform. In versions 29.0 and prior, multiple AVideo JSON endpoints under `objects/` accept state-changing requests via `$_REQUEST`/`$_GET` and persist changes tied to the caller's session user, without any anti-CSRF token, origin check, or referer check. A malicious page visited by a logged-in victim can silently cast/flip the victim's like/dislike on any comment (`objects/comments_like.json.php`), post a comment authored by the victim on any video, with attacker-chosen text (`objects/commentAddNew.json.php`), and/or delete assets from any category (`objects/categoryDeleteAssets.json.php`) when the victim has category management rights. Each endpoint is reachable from a browser via a simple `<img src="…">` tag or form submission, so exploitation only requires the victim to load an attacker-controlled HTML resource. Commit 7aaad601bd9cd7b993ba0ee1b1bea6c32ee7b77c contains a fix.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS