What is the CVSS score of CVE-2026-40926?

CVE-2026-40926 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of WWBN AVideo are affected by CVE-2026-40926?

WWBN AVideo versions 29.0 and prior contain a cross-site request forgery vulnerability in content management endpoints where publicly available exploit code exists.

How to fix or mitigate CVE-2026-40926?

Within 24 hours, restrict administrative access to known IP addresses and disable unused plugins to reduce attack surface; notify all administrators of potential phishing attempts targeting their sessions. Within 7 days, implement detailed logging and alerting on all category and plugin configuration changes, and begin evaluation of platform upgrade paths or alternative solutions with vendor. Within 30 days, deploy web application firewall rules to detect and block CSRF patterns, implement short session timeouts for admin accounts (15-30 minutes), and complete phishing awareness training for administrative staff; monitor vendor advisories for patch availability.

WWBN AVideo CVE-2026-40926

HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-04-21 security-advisories@github.com

GHSA-ffw8-fwxp-h64w

PHP CSRF Avideo Wwbn

7.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

vuln.today AI

7.1 HIGH

Classic CSRF: attacker is unauthenticated (PR:N) but needs a logged-in admin to interact (UI:R); write and plugin-execution give I:H, minor A:L, and no data disclosure (C:N).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

Low

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 05:30 vuln.today

Analysis Generated

Jul 24, 2026 - 05:30 vuln.today

CVE Published

Apr 21, 2026 - 23:16 nvd

HIGH 7.1

DescriptionGitHub Advisory

WWBN AVideo is an open source video platform. In versions 29.0 and prior, three admin-only JSON endpoints - objects/categoryAddNew.json.php, objects/categoryDelete.json.php, and objects/pluginRunUpdateScript.json.php - enforce only a role check (Category::canCreateCategory() / User::isAdmin()) and perform state-changing actions against the database without calling isGlobalTokenValid() or forbidIfIsUntrustedRequest(). Peer endpoints in the same directory (pluginSwitch.json.php, pluginRunDatabaseScript.json.php) do enforce the CSRF token, so the missing checks are an omission rather than a design choice. An attacker who lures a logged-in admin to a malicious page can create, update, or delete categories and force execution of any installed plugin's updateScript() method in the admin's session. Commit ee5615153c40628ab3ec6fe04962d1f92e67d3e2 contains a fix.

AnalysisAI

Cross-site request forgery in WWBN AVideo (versions 29.0 and prior) lets an attacker abuse a logged-in admin's session against three state-changing JSON endpoints (categoryAddNew, categoryDelete, and pluginRunUpdateScript) that enforce only a role check and omit the CSRF token validation their sibling endpoints use. By luring an authenticated administrator to a malicious page, an attacker can create, overwrite, or delete video categories and trigger execution of any installed plugin's updateScript() method. Publicly available exploit code exists per the SSVC assessment, though EPSS is very low (0.02%, 5th percentile) and it is not on the CISA KEV list.

Technical ContextAI

AVideo is a PHP open-source video streaming and hosting platform. Its CSRF protection is not enforced by a global framework filter; instead each endpoint must explicitly call forbidIfIsUntrustedRequest() or isGlobalTokenValid() (defined in objects/functions.php:2313), which validates a per-request globalToken parameter. The three vulnerable endpoints in objects/ gated their write and plugin-execution logic behind Category::canCreateCategory() / User::isAdmin() but never invoked the token check, while peers such as pluginSwitch.json.php and pluginRunDatabaseScript.json.php did. This is a textbook CWE-352 (Cross-Site Request Forgery): a server action authorized purely by an ambient session cookie with no unpredictable, request-bound anti-CSRF token. Notably categoryAddNew loads the row via new Category(intval(@$_POST['id'])), so a non-zero id overwrites an existing category rather than only creating one, and pluginRunUpdateScript can invoke any installed plugin's updateScript() routine. The affected product is identified by cpe:2.3:a:wwbn:avideo, and the tags (PHP, CSRF) match the root cause.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed. Apply commit ee5615153c40628ab3ec6fe04962d1f92e67d3e2 (https://github.com/WWBN/AVideo/commit/ee5615153c40628ab3ec6fe04962d1f92e67d3e2), which adds forbidIfIsUntrustedRequest() to the three vulnerable endpoints and also hardens roughly a dozen other admin JSON endpoints in the same change (userDelete, videoDelete, notifySubscribers, configurationClearCache, userGroupsAddNew/Delete, videoStatus/Swap/Refresh/Rotate, and others); track GHSA-ffw8-fwxp-h64w for a packaged release. Until a tagged release ships, compensating controls include restricting access to objects/categoryAddNew.json.php, objects/categoryDelete.json.php, and objects/pluginRunUpdateScript.json.php at the web-server or WAF layer (for example, allow only trusted admin source IPs), and enforcing SameSite=Strict or Lax on the admin session cookie so cross-site requests do not carry it - the trade-off being that strict SameSite can break legitimate cross-origin admin links. Advising admins to log out of the panel when idle and avoid browsing untrusted sites in the same session further narrows the lure window.