What is the CVSS score of CVE-2026-34611?

CVE-2026-34611 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-34611?

Yes, a patch is available for CVE-2026-34611. Update the affected software to the latest version immediately.

PHP CVE-2026-34611

EUVD-2026-17638 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-03-31 GitHub_M

GHSA-c4xj-x7p8-3x7q

PHP CSRF

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Patch released

Apr 02, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Mar 31, 2026 - 21:14 euvd

EUVD-2026-17638

Analysis Generated

Mar 31, 2026 - 21:14 vuln.today

CVE Published

Mar 31, 2026 - 20:42 nvd

MEDIUM 6.5

DescriptionGitHub Advisory

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo endpoint objects/emailAllUsers.json.php allows administrators to send HTML emails to every registered user on the platform. While the endpoint verifies admin session status, it does not validate a CSRF token. Because AVideo sets SameSite=None on session cookies, a cross-origin POST request from an attacker-controlled page will include the admin's session cookie automatically. An attacker who lures an admin to a malicious page can send an arbitrary HTML email to every user on the platform, appearing to originate from the instance's legitimate SMTP address. At time of publication, there are no publicly available patches.

AnalysisAI

CSRF vulnerability in WWBN AVideo 26.0 and prior allows unauthenticated attackers to send arbitrary HTML emails to all platform users by luring administrators to a malicious webpage. The vulnerability exploits absent CSRF token validation on the emailAllUsers.json.php endpoint combined with SameSite=None session cookie configuration, enabling cross-origin POST requests to execute with the admin's session credentials. An attacker can impersonate the platform's legitimate SMTP sender to distribute phishing emails, spam, or malware links to the entire user base without any authentication requirement beyond initial admin compromise via social engineering.

Technical ContextAI

WWBN AVideo is a PHP-based open-source video platform that manages user accounts, sessions, and email distribution through REST API endpoints. The vulnerable endpoint objects/emailAllUsers.json.php is designed to allow administrators to broadcast emails to all registered users. The application relies on session cookies (with SameSite=None attribute) for authentication but fails to implement Cross-Site Request Forgery (CSRF) token validation on this high-impact administrative function. CWE-352 (Cross-Site Request Forgery) identifies the root cause: the endpoint trusts requests based solely on authenticated session presence without verifying a cryptographic token generated per-request. The SameSite=None configuration explicitly permits the browser to include session cookies in cross-origin POST requests, eliminating the browser's default CSRF mitigation. This is typical in legacy PHP applications that predate modern CSRF defense practices.

RemediationAI

No vendor-released patch identified at time of analysis. The GHSA advisory at https://github.com/WWBN/AVideo/security/advisories/GHSA-c4xj-x7p8-3x7q provides the official disclosure. Immediate workarounds pending an upstream fix include: (1) disable or restrict network access to the objects/emailAllUsers.json.php endpoint via web server configuration (nginx/Apache) or application-level routing, (2) implement CSRF token validation in the application code by regenerating and verifying a unique token on every email broadcast request, (3) change session cookie configuration from SameSite=None to SameSite=Strict or SameSite=Lax to prevent cross-origin cookie inclusion, and (4) educate administrators against visiting untrusted links and consider restricting email broadcast functionality to internal-only network access. Monitor the official GitHub repository for patched releases.