PT-2026-29358 · Avideo · Avideo

Adrgs · Published 2026-03-31 · Updated 2026-04-01 · CVE-2026-34611

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions AVideo versions 26.0 and prior

Description The AVideo platform, in versions 26.0 and prior, has an issue in the objects/emailAllUsers.json.php endpoint. This endpoint allows administrators to send HTML emails to all registered users. The endpoint verifies admin session status but does not validate a CSRF token. Because AVideo sets SameSite=None on session cookies, a cross-origin POST request from an attacker-controlled page will automatically include the admin's session cookie. An attacker can trick an administrator into visiting a malicious page and then send an arbitrary HTML email to every user on the platform, appearing to come from the instance's legitimate SMTP address.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-34611

GHSA-C4XJ-X7P8-3X7Q

Affected Products

Avideo

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34611.json · Exploit
• 🔥 https://github.com/WWBN/AVideo/security/advisories/GHSA-c4xj-x7p8-3x7q · Exploit
• https://osv.dev/vulnerability/CVE-2026-34611 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c4xj-x7p8-3x7q · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34611 · Security Note
• https://github.com/WWBN/AVideo · Note
• https://github.com/WWBN/AVideo/commit/226ad24a51edac57e079ac92ca95c82e1e23e3cf · Note
• https://twitter.com/CVEnew/status/2039372124599558520 · Twitter Post