WWBN AVideo CVE-2026-40925

Exploitation requires (1) a victim who is a currently logged-in AVideo administrator (User::isAdmin() must pass via their live session), and (2) that admin to visit or render attacker-controlled content while that session is active - this is the UI:R user-interaction requirement. The flaw is reachable in default deployments because $global['disableAdvancedConfigurations'] is empty by default (exposing encoder/SMTP writes) and because AVideo ships with session.cookie_samesite=None, which is what allows the cross-origin cookie to be sent; if an operator has set SameSite to Lax/Strict or restricted admin-endpoint access, the browser will not attach the session and the attack fails. No attacker credentials are needed. The limiting factors are the need to target an authenticated admin and to get that admin to interact with the malicious page - there is no purely server-side unauthenticated path.

Signals are mixed but coherent for a targeted-CSRF profile. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L, score 8.3) correctly reflects a network-delivered attack that requires victim interaction (admin must visit a hostile page) and yields high confidentiality/integrity impact; the SameSite=None setting materially lowers real complexity. SSVC records Exploitation: PoC, Automatable: no, Technical Impact: total - 'total' matches the full-config-takeover outcome, while 'no' automatable reflects the need to catch an authenticated admin. EPSS is 0.02% (4th percentile) and the CVE is not in CISA KEV, indicating no evidence of widespread active exploitation. The honest read: this is a genuine high-impact issue that is not mass-exploitable - it depends on social-engineering a specific admin - so prioritize it for internet-facing AVideo instances with active admins, but it is not an indiscriminate wormable threat. Note UI:R is the key limiter that keeps this from being a drive-by against the server itself.

An attacker crafts a web page containing a hidden auto-submitting form (or fetch) that POSTs a full configuration payload to https://victim-avideo/updateConfig, then phishes or otherwise lures a logged-in AVideo administrator to open it. Because the admin's session cookie is sent cross-origin (SameSite=None) and the endpoint performs no token/Origin validation, the browser silently applies attacker-chosen values - e.g. repointing the encoder URL and SMTP host to attacker infrastructure and injecting malicious <head> HTML. Public PoC/exploit code exists per SSVC, lowering the barrier to reliable exploitation.