Executive brief
WWBN AVideo is a video streaming and live transmission platform. The application fails to validate CSRF tokens on administrative functions that manage live broadcast history. An attacker can craft a malicious webpage that, when visited by an administrator, deletes all live transmission history or marks active streams as finished, causing operational disruption and data loss without the administrator's knowledge.
Technical details
The vulnerability is a cross-site request forgery (CWE-352) in deleteHistory.json.php and finishAll.json.php. These endpoints modify global live state based on GET requests and check only User::isAdmin() without validating CSRF tokens or requiring POST. The CSRF protection mechanism autoCSRFGuard() only runs on POST requests and never protects these GET-reachable endpoints. An unauthenticated attacker can craft a simple HTML page with image tags pointing to these endpoints; when an administrator visits the attacker's page, their browser automatically sends the GET request in an admin session, deleting all history or marking streams as finished. No patch was available at the time of advisory publication.
Affected products
- WWBN AVideo <= c3edcc274c389816d434acadac07ee78eaf330c1 (master branch, 2026-08-23)
Timeline
- 2026-08-24: disclosed: Security advisory published on GitHub (GHSA-gmx5-mhqr-h7rj)
- 2026-09-08: advisory: CVE-2026-86718 published