Executive brief
WWBN AVideo is an open-source video sharing platform. A security flaw allows an attacker to trick a logged-in administrator into unknowingly disabling critical security and functional plugins by visiting a malicious website. This could lead to the deactivation of two-factor authentication, payment gateways, or access controls, potentially exposing private content or allowing unauthorized access to the system.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in the 'objects/pluginSwitch.json.php' endpoint of WWBN AVideo versions 26.0 and prior. The endpoint fails to validate CSRF tokens and is explicitly excluded from ORM-level Referer/Origin domain validation via the 'ignoreTableSecurityCheck()' function. Because session cookies use 'SameSite=None' and plugin UUIDs are hardcoded constants exposed in frontend JavaScript, an unauthenticated remote attacker can craft a malicious page that, when visited by an authenticated administrator, silently disables plugins. This can be used to bypass security features like LoginControl (2FA), subscription enforcement, or access control plugins. As of publication, no official patches are available.
Affected products
- WWBN AVideo <= 26.0
Timeline
- 2026-03-30: advisory: GitHub Security Advisory published by maintainer
- 2026-03-31: disclosed: CVE-2026-34613 published to NVD