WWBN AVideo CVE-2026-40929

Three conditions must simultaneously hold: (1) The victim must be authenticated to the AVideo instance with comment deletion authority - specifically as a site moderator (Permissions::canAdminComment() returns true), a video owner (owns the video the comment is on), or the original comment author. Anonymous visitors cannot be targeted. (2) AVideo must have session.cookie_samesite=None set in its session configuration, which the platform documentation describes as an intentional default to support cross-origin embed players - non-default hardened deployments that override this to Lax or Strict are not exploitable via standard browser CSRF. (3) The victim must actively visit an attacker-controlled web page or resource (UI:R) while their session is active. Exploitation is limited to deleting only comments the victim has authority to remove - an attacker cannot use a moderator's session to delete comments outside that moderator's permission scope.

The CVSS 5.4 Medium score (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) accurately reflects that the attacker requires no credentials but the attack depends on a privileged victim visiting an attacker-controlled page. The SameSite=None platform default, however, raises practical exploitability above what the raw score suggests: in most CSRF scenarios, SameSite=Lax or Strict cookies are the primary mitigation, but that defense is explicitly absent here. EPSS of 0.01% (3rd percentile) indicates very low likelihood of broad automated exploitation, consistent with SSVC's 'Automatable: no' - each attack must target a specific authenticated user. SSVC 'Technical Impact: partial' aligns with the limited blast radius (only comments the victim has authority to delete are affected). No KEV listing confirms no confirmed mass exploitation at time of analysis. The principal real-world risk is targeted content sabotage against community managers, moderators, or content creators rather than opportunistic mass exploitation.

An attacker identifies a site moderator's username and crafts a page containing a hidden HTML form that auto-submits POST requests to https://target-avideo-instance.com/objects/commentDelete.json.php with sequential or enumerated comment IDs. When the moderator visits the attacker's page while authenticated, their browser automatically attaches the PHPSESSID cookie (which is SameSite=None) to each cross-origin request, causing the server to authenticate and execute each deletion. Publicly available exploit code exists per SSVC data, lowering the barrier to execution of this scenario.