What is the CVSS score of CVE-2026-40925?

CVE-2026-40925 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of WWBN AVideo are affected by CVE-2026-40925?

WWBN AVideo versions 29.0 and earlier contain a cross-site request forgery vulnerability in the configuration endpoint that permits attacker-driven manipulation of global site settings when…

How to fix or mitigate CVE-2026-40925?

Within 24 hours, audit administrator access logs and review all configuration changes for anomalies. Within 7 days, implement network-level restrictions on the /updateConfig endpoint via reverse proxy or WAF rules, or disable it if site configuration updates are infrequent. Within 30 days, monitor WWBN AVideo security advisories for a patched version exceeding 29.0; implement code-level mitigations including anti-CSRF token validation, Origin/Referer header checking, and forbidIfIsUntrustedRequest() calls to the configurationUpdate.json.php endpoint; and enforce 2FA/MFA for all administrator accounts to reduce social engineering attack surface.

WWBN AVideo CVE-2026-40925

EUVD-2026-24485 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-04-21 GitHub_M

GHSA-vvfw-4m39-fjqf

CSRF PHP Avideo

8.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.3 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L

vuln.today AI

8.3 HIGH

Classic CSRF: attacker has no privileges (PR:N) but needs the admin to interact (UI:R); config takeover exposes SMTP creds (C:H) and rewrites settings (I:H), with limited availability impact (A:L).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 07:04 vuln.today

Analysis Generated

Jul 24, 2026 - 07:04 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24485

CVE Published

Apr 21, 2026 - 19:58 nvd

HIGH 8.3

DescriptionGitHub Advisory

WWBN AVideo is an open source video platform. In versions 29.0 and prior, objects/configurationUpdate.json.php (also routed via /updateConfig) persists dozens of global site settings from $_POST but protects the endpoint only with User::isAdmin(). It does not call forbidIfIsUntrustedRequest(), does not verify a globalToken, and does not validate the Origin/Referer header. Because AVideo intentionally sets session.cookie_samesite=None to support cross-origin iframe embedding, a logged-in administrator who visits an attacker-controlled page will have the browser auto-submit a cross-origin POST that rewrites the site's encoder URL, SMTP credentials, site <head> HTML, logo, favicon, contact email, and more in a single request. Commit f9492f5e6123dff0292d5bb3164fde7665dc36b4 contains a fix.

AnalysisAI

Cross-site request forgery in WWBN AVideo (versions ≤ 29.0) lets an attacker fully rewrite global site configuration by luring a logged-in administrator to a malicious page. The objects/configurationUpdate.json.php endpoint (aka /updateConfig) gates only on User::isAdmin() and omits any anti-CSRF token, Origin/Referer check, or forbidIfIsUntrustedRequest() call, so a single auto-submitted cross-origin POST can overwrite the encoder URL, SMTP credentials, site <head> HTML, logo, favicon, and contact email. Publicly available exploit code exists (SSVC: PoC) but the flaw is not in CISA KEV, and EPSS is very low at 0.02%.

Technical ContextAI

AVideo is a self-hosted PHP open-source video streaming/CMS platform (CPE cpe:2.3:a:wwbn:avideo). The root cause is CWE-352 (Cross-Site Request Forgery): a state-changing admin endpoint that persists dozens of settings straight from $_POST into the AVideoConf object with no request-authenticity control beyond a session-based admin check. The exposure is amplified by an intentional platform design choice - AVideo sets session.cookie_samesite=None to support cross-origin iframe embedding - which defeats the browser's default SameSite CSRF protection and allows the admin session cookie to ride along with cross-site POSTs. Advanced configuration writes (encoder URL, SMTP block) are reachable because $global['disableAdvancedConfigurations'] is empty by default, and the handler even performs base64-to-file writes for logo/favicon that feed an ImageMagick convert invocation.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - the fix commit f9492f5e6123dff0292d5bb3164fde7665dc36b4 adds forbidIfIsUntrustedRequest('configurationUpdate'); to the endpoint, and Composer metadata lists no tagged fixed release, so apply the commit from source (https://github.com/WWBN/AVideo/commit/f9492f5e6123dff0292d5bb3164fde7665dc36b4) and monitor the advisory GHSA-vvfw-4m39-fjqf for a numbered release. Until patched, restrict access to the admin/configuration functionality and the /updateConfig and objects/configurationUpdate.json.php paths at a reverse proxy to trusted admin source IPs (trade-off: breaks admin access from other networks), and consider enforcing an Origin/Referer allowlist for POSTs to that endpoint at the WAF/proxy layer. Where cross-origin iframe embedding is not required, override the platform default and set session.cookie_samesite=Lax/Strict to restore browser CSRF protection (trade-off: breaks embedded-player use cases that rely on SameSite=None). Advise administrators to log out of AVideo when not actively managing it and to avoid browsing untrusted sites within an authenticated admin session.