What is the CVSS score of CVE-2026-34394?

CVE-2026-34394 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-34394?

WWBN AVideo 26.0 and earlier contain a critical CSRF vulnerability in the admin configuration endpoint that allows attackers to manipulate payment processors, authentication providers, and cloud…

How to fix or mitigate CVE-2026-34394?

Within 24 hours: Audit admin/save.json.php access logs for unauthorized configuration changes; notify all AVideo administrators to avoid clicking untrusted links while logged in. Within 7 days: Implement network-level CSRF protection (WAF rules blocking requests to admin/save.json.php lacking valid CSRF tokens); restrict admin console access to internal networks or VPN only. Within 30 days: Contact WWBN for patch availability; evaluate migration to alternative video platform or implement application-level CSRF token validation as temporary mitigation if internal development resources permit.

PHP CVE-2026-34394

EUVD-2026-17630 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-03-31 GitHub_M

GHSA-4wwr-7h7c-chqr

CSRF PHP

8.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 31, 2026 - 21:14 euvd

EUVD-2026-17630

Analysis Generated

Mar 31, 2026 - 21:14 vuln.today

CVE Published

Mar 31, 2026 - 20:39 nvd

HIGH 8.1

DescriptionGitHub Advisory

WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo's admin plugin configuration endpoint (admin/save.json.php) lacks any CSRF token validation. There is no call to isGlobalTokenValid() or verifyToken() before processing the request. Combined with the application's explicit SameSite=None cookie policy, an attacker can forge cross-origin POST requests from a malicious page to overwrite arbitrary plugin settings on a victim administrator's session. Because the plugins table is included in the ignoreTableSecurityCheck() array in objects/Object.php, standard table-level access controls are also bypassed. This allows a complete takeover of platform functionality by reconfiguring payment processors, authentication providers, cloud storage credentials, and more. At time of publication, there are no publicly available patches.

AnalysisAI

Cross-site request forgery in WWBN AVideo 26.0 and earlier enables remote attackers to reconfigure critical plugin settings through forged requests targeting admin/save.json.php. The endpoint lacks CSRF token validation while the application sets SameSite=None cookies, allowing attackers to manipulate payment processors, authentication providers, and cloud storage credentials by tricking authenticated administrators into visiting malicious pages. No vendor-released patch identified at time of analysis. EPSS data unavailable; not listed in CISA KEV; no public exploit identified at time of analysis, though exploitation requires only standard CSRF techniques.

Technical ContextAI

AVideo is a PHP-based open source video streaming platform. The vulnerability stems from missing CSRF protection (CWE-352) in the admin plugin configuration endpoint (admin/save.json.php). The endpoint processes POST requests without calling isGlobalTokenValid() or verifyToken() validation functions. This architectural weakness is compounded by two implementation choices: the application explicitly sets SameSite=None on session cookies (allowing cross-origin cookie transmission), and the plugins table is added to ignoreTableSecurityCheck() in objects/Object.php, bypassing standard table-level access controls. This combination permits unrestricted modification of plugin configurations through forged cross-origin requests, affecting core platform functionality including payment processing, identity federation, and cloud infrastructure integration.

RemediationAI

No vendor-released patch identified at time of analysis per the GitHub security advisory. Organizations should implement immediate compensating controls: deploy web application firewall rules to enforce CSRF token validation on admin/* endpoints, modify cookie configuration to remove SameSite=None attribute (changing to SameSite=Strict or Lax), implement same-origin validation in admin/save.json.php, and restrict administrative access to dedicated networks or VPN-only access. Monitor the official GitHub security advisory at https://github.com/WWBN/AVideo/security/advisories/GHSA-4wwr-7h7c-chqr for patch availability updates. Consider code-level remediation by adding isGlobalTokenValid() or verifyToken() calls before processing requests in admin/save.json.php and removing plugins table from ignoreTableSecurityCheck() array in objects/Object.php if custom patching is feasible.