WWBN AVideo
CVE-2026-40929
MEDIUM
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Attacker needs no credentials (PR:N); victim must actively visit attacker page (UI:R); SameSite=None default makes cross-origin cookie delivery trivially reliable (AC:L); impact limited to comment deletion (I:L, A:L, C:N).
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
WWBN AVideo is an open source video platform. In versions 29.0 and prior, objects/commentDelete.json.php is a state-mutating JSON endpoint that deletes comments but performs no CSRF validation. It does not call forbidIfIsUntrustedRequest(), does not verify a CSRF/global token, and does not check Origin/Referer. Because AVideo intentionally sets session.cookie_samesite=None (to support cross-origin embed players), a cross-site request from any attacker-controlled page automatically carries the victim's PHPSESSID. Any authenticated victim who has authority to delete one or more comments (site moderators, video owners, and comment authors) can be tricked into deleting comments en masse simply by visiting an attacker page. Commit 184f36b1896f3364f864f17c1acca3dd8df3af27 contains a fix.
AnalysisAI
Cross-site request forgery in WWBN AVideo 29.0 and prior allows an unauthenticated attacker to trigger mass comment deletion on behalf of any authenticated victim (moderator, video owner, or comment author) who visits a malicious page. The attack is critically amplified by AVideo's deliberate platform setting of session.cookie_samesite=None, which strips the browser's native CSRF defense and guarantees the victim's session cookie travels with every cross-origin request. Publicly available exploit code exists per SSVC data; the vulnerability is not listed in CISA KEV at time of analysis.
Technical ContextAI
The vulnerable endpoint is objects/commentDelete.json.php (CPE: cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*), a PHP JSON API that performs a destructive SQL DELETE via Comment::delete() without any CSRF guard - no forbidIfIsUntrustedRequest() call, no token/nonce parameter, and no Origin or Referer validation. Root cause is CWE-352 (Cross-Site Request Forgery). The vulnerability is compounded by an intentional platform decision to set session.cookie_samesite=None to support cross-origin embed players; this means browser SameSite protections, which would otherwise block most CSRF attacks in modern browsers, are fully bypassed by design. The endpoint reads its target ID from $_REQUEST, accepting both GET and POST, making exploitation possible via an HTML <img src> tag (GET) or an auto-submitting form or fetch() call (POST).
RemediationAI
The upstream fix is available in commit 184f36b1896f3364f864f17c1acca3dd8df3af27 (https://github.com/WWBN/AVideo/commit/184f36b1896f3364f864f17c1acca3dd8df3af27), which adds forbidIfIsUntrustedRequest('commentDelete') directly to the vulnerable endpoint and introduces a broad autoCSRFGuard() function in functionsSecurity.php that automatically protects all POST requests to *.json.php endpoints. No formally tagged patched release version has been identified in package metadata (composer shows 'fixed in: None'), so operators should apply the patch commit directly or track the upstream repository for a tagged release. As a compensating control prior to patching, operators can set session.cookie_samesite=Lax or Strict in the PHP session configuration - note this will break cross-origin embed player functionality, which is the trade-off that drove the original SameSite=None design. Alternatively, operators can restrict access to commentDelete.json.php at the web server layer to same-origin requests by validating the Origin or Referer header in an nginx/Apache rewrite rule, though this requires careful testing against legitimate player integrations.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today