What is the CVSS score of CVE-2026-34613?

CVE-2026-34613 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-34613?

Yes, a patch is available for CVE-2026-34613. Update the affected software to the latest version immediately.

PHP CVE-2026-34613

EUVD-2026-17639 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-03-31 GitHub_M

GHSA-hqxf-mhfw-rc44

CSRF PHP

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Patch released

Apr 02, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Mar 31, 2026 - 21:14 euvd

EUVD-2026-17639

Analysis Generated

Mar 31, 2026 - 21:14 vuln.today

CVE Published

Mar 31, 2026 - 20:45 nvd

MEDIUM 6.5

DescriptionGitHub Advisory

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo endpoint objects/pluginSwitch.json.php allows administrators to enable or disable any installed plugin. The endpoint checks for an active admin session but does not validate a CSRF token. Additionally, the plugins database table is explicitly listed in ignoreTableSecurityCheck(), which means the ORM-level Referer/Origin domain validation in ObjectYPT::save() is also bypassed. Combined with SameSite=None on session cookies, an attacker can disable critical security plugins (such as LoginControl for 2FA, subscription enforcement, or access control plugins) by luring an admin to a malicious page. At time of publication, there are no publicly available patches.

AnalysisAI

CSRF vulnerability in WWBN AVideo 26.0 and prior allows unauthenticated attackers to disable critical security plugins on admin accounts via malicious web pages, exploiting missing CSRF token validation combined with SameSite=None session cookies and ORM-level security bypass. An attacker can trick an authenticated administrator into visiting a crafted webpage that silently disables plugins such as LoginControl (2FA), subscription enforcement, or access control mechanisms, compromising the platform's security posture without the admin's knowledge or consent.

Technical ContextAI

WWBN AVideo is a PHP-based open-source video platform. The vulnerability exists in the pluginSwitch.json.php endpoint, which handles plugin enable/disable operations. The root cause is CWE-352 (Cross-Site Request Forgery), compounded by multiple security configuration failures: the endpoint performs admin session validation but omits CSRF token checks, the plugins database table is explicitly whitelisted in ignoreTableSecurityCheck(), which disables ORM-level Referer/Origin domain validation in ObjectYPT::save(), and session cookies are configured with SameSite=None, allowing cross-origin cookie transmission. This combination creates an exploitation pathway where an attacker's malicious page can force an authenticated admin's browser to make unauthorized state-changing requests.

RemediationAI

At time of analysis, no vendor-released patch has been confirmed. AVideo administrators should implement immediate compensating controls: enable CSRF token validation by patching the pluginSwitch.json.php endpoint to require a valid, session-specific token verified server-side before processing plugin enable/disable requests; configure session cookies with SameSite=Strict or SameSite=Lax instead of SameSite=None to prevent cross-origin cookie transmission; review and remove the plugins table from ignoreTableSecurityCheck() to restore ORM-level domain validation; implement Content-Security-Policy headers to limit cross-origin requests; and restrict access to admin endpoints via network controls if possible. Monitor official WWBN AVideo channels and the GitHub security advisory (https://github.com/WWBN/AVideo/security/advisories/GHSA-hqxf-mhfw-rc44) for patch release announcements. Until a patch is available, educate administrators to avoid clicking untrusted links while logged into AVideo dashboards.