CVE-2026-45610: WWBN AVideo CSRF in 2FA toggle

CVE-2026-45610 · Severity: medium · CVSS 5.7 · Published 2026-05-29

WWBN AVideo is an open-source platform used for hosting and managing video content. A security flaw in the platform's login control settings allows an attacker to silently disable a user's Two-Factor Authentication (2FA) if the user visits a malicious website while logged into their AVideo account. This effectively removes a critical layer of security, making the account vulnerable to takeover through simple password theft or credential stuffing.

Technologies: wwbn/avideo (Packagist), WWBN AVideo. Vendors: Packagist, WWBN.

Quick answers

Is CVE-2026-45610 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-45610 being exploited in the wild.
How severe is CVE-2026-45610?
Medium severity, with a CVSS score of 5.7, published 29 May 2026.
Which products and versions are affected?
wwbn/avideo (Packagist) <= 29.0, ECOSYSTEM:introduced=0,last_affected=29.0; WWBN AVideo <= 29.0.
Is there a fix for CVE-2026-45610?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-45610 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-45610?
Check whether you run wwbn/avideo (Packagist) or WWBN AVideo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in the `plugin/LoginControl/set.json.php` endpoint of WWBN AVideo. The endpoint lacks CSRF protection mechanisms such as `forbidIfIsUntrustedRequest()` calls, token validation (`isTokenValid`), or SameSite=Strict cookie enforcement. An attacker can host a malicious page that auto-submits a POST request to this endpoint with `type=set2FA` and `value=false`. If a logged-in user visits the attacker's site, their browser will include their session cookies in the request, causing the server to disable 2FA for their account without their knowledge or consent. This vulnerability is particularly severe as it lacks a re-authentication step (password or 2FA code prompt) for disabling security-sensitive features. As of the advisory, no patch is explicitly mentioned, though the root cause is the omission of standard AVideo CSRF helpers in this specific file.

Affected products

  • WWBN AVideo <= 29.0

Identifiers

  • CVE-2026-45610
  • GHSA-3mv2-vmwh-rwfx

Timeline

  • 2026-05-11: advisory: GitHub security advisory published by researcher
  • 2026-05-29: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.