Executive brief
WWBN AVideo is an open-source video hosting and streaming platform. A security flaw allows an attacker to trick an administrator into visiting a malicious website that silently changes the platform's settings. This can lead to a total takeover of the system, including the redirection of customer payments to the attacker, theft of cloud storage credentials, or modification of login providers.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in WWBN AVideo versions 26.0 and prior due to a lack of token validation in the 'admin/save.json.php' endpoint. The application fails to call 'isGlobalTokenValid()' or 'verifyToken()' before processing POST requests to update plugin configurations. This is exacerbated by an explicit 'SameSite=None' cookie policy and the fact that the 'plugins' table is included in the 'ignoreTableSecurityCheck()' array, bypassing standard ORM-level access controls. An unauthenticated remote attacker can exploit this by inducing an authenticated administrator to visit a malicious page, enabling the attacker to overwrite arbitrary plugin settings, such as payment processor details (PayPal/Stripe) or AWS S3 credentials. As of publication, no official patches are available.
Affected products
- WWBN AVideo <= 26.0
Timeline
- 2026-03-27: advisory: Initial advisory published by GitHub/WWBN
- 2026-03-31: disclosed: CVE-2026-34394 assigned