PT-2026-34199 · Wwbn · Avideo

Published 2026-04-14 · Updated 2026-04-26 · CVE-2026-40929

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions WWBN AVideo versions prior to 29.1

Description A state-mutating JSON endpoint 'objects/commentDelete.json.php' fails to perform Cross-Site Request Forgery (CSRF) validation. The endpoint does not utilize the forbidIfIsUntrustedRequest() function, verify CSRF or global tokens, or check the Origin and Referer headers. Due to the software setting session.cookie samesite=None to support cross-origin embed players, requests from attacker-controlled pages automatically include the victim's PHPSESSID. This allows an attacker to trick authenticated users with deletion privileges, such as site moderators, video owners, and comment authors, into deleting comments en masse by visiting a malicious page.

Recommendations Update to a version that includes commit 184f36b1896f3364f864f17c1acca3dd8df3af27.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-40929

GHSA-8QM8-G55H-XMQR

Affected Products

Avideo

References · 7

• 🔥 https://github.com/WWBN/AVideo/security/advisories/GHSA-8qm8-g55h-xmqr · Exploit
• https://github.com/WWBN/AVideo/commit/184f36b1896f3364f864f17c1acca3dd8df3af27 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-40929 · Security Note
• https://osv.dev/vulnerability/GHSA-8qm8-g55h-xmqr · Vendor Advisory
• https://github.com/WWBN/AVideo · Note
• https://twitter.com/VulmonFeeds/status/2046879070709751855 · Twitter Post
• https://twitter.com/CVEnew/status/2048481076339728540 · Twitter Post