PT-2026-34197 · Wwbn · Avideo

Published 2026-04-14 · Updated 2026-04-26 · CVE-2026-40926

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions WWBN AVideo versions 29.0 and earlier

Description Cross-Site Request Forgery occurs in three admin-only JSON endpoints: 'objects/categoryAddNew.json.php', 'objects/categoryDelete.json.php', and 'objects/pluginRunUpdateScript.json.php'. These endpoints perform state-changing database actions by enforcing only role checks via Category::canCreateCategory() and User::isAdmin(), while failing to call isGlobalTokenValid() or forbidIfIsUntrustedRequest(). This allows an attacker to lure a logged-in administrator to a malicious page to create, update, or delete categories and force the execution of any installed plugin's updateScript() method within the administrator's session.

Recommendations Update to a version containing commit ee5615153c40628ab3ec6fe04962d1f92e67d3e2.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-40926

GHSA-FFW8-FWXP-H64W

Affected Products

Avideo

References · 8

• 🔥 https://github.com/WWBN/AVideo/security/advisories/GHSA-ffw8-fwxp-h64w · Exploit
• https://github.com/WWBN/AVideo/commit/ee5615153c40628ab3ec6fe04962d1f92e67d3e2 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-40926 · Security Note
• https://osv.dev/vulnerability/GHSA-ffw8-fwxp-h64w · Vendor Advisory
• https://github.com/WWBN/AVideo · Note
• https://twitter.com/CVEnew/status/2048481083449090307 · Twitter Post
• https://twitter.com/TheRabbitPy/status/2046854039523008598 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2046889308540264492 · Twitter Post