Executive brief
WWBN AVideo is an open-source platform used for hosting and managing video content. A security flaw allows an attacker to trick an administrator into unknowingly changing the video player's appearance across the entire site. This could be used to disrupt video playback, deface the platform, or facilitate social engineering attacks against users.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in WWBN AVideo versions 26.0 and prior within the 'admin/playerUpdate.json.php' endpoint. The application fails to validate CSRF tokens when processing POST requests to update the player skin. Furthermore, the 'plugins' table is explicitly excluded from the ORM's domain-based security checks via 'ignoreTableSecurityCheck()', and session cookies use 'SameSite=None', facilitating cross-origin attacks. An unauthenticated remote attacker can exploit this by inducing an authenticated administrator to visit a malicious webpage, resulting in unauthorized platform-wide configuration changes. As of the advisory date, no official patch is confirmed, but adding 'isGlobalTokenValid()' checks is the recommended mitigation.
Affected products
- WWBN AVideo <= 26.0
Timeline
- 2026-04-01: advisory: GitHub Security Advisory published by maintainer
- 2026-04-06: disclosed: CVE published to NVD