Executive brief
WWBN AVideo is a video streaming platform software. The CustomizeUser plugin (enabled by default) contains a cross-site request forgery flaw that allows an attacker to hijack an administrator's session by redirecting them to a non-admin user account. This causes the administrator to lose administrative access and control of the system until they manually cancel the swap.
Technical details
The vulnerability is a cross-site request forgery (CWE-352) in the plugin/CustomizeUser/swapUser.json.php endpoint. The endpoint reads the users_id parameter from $_REQUEST and calls User::swapUser() without CSRF token validation (forbidIfNotPost() or forbidIfInvalidToken()), and the global autoCSRFGuard() check only applies to POST requests. An unauthenticated attacker can trigger a GET request from an admin's browser (via an <img> tag, link, or other mechanism) to swap the admin's session to a non-admin account. The attacker cannot escalate to admin privileges (admin-to-admin swaps are rejected), but can disable admin access. The endpoint also leaks the session_id in the JSON response.
Affected products
- WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 (master branch as of 2026-08-23)
Timeline
- 2026-08-24: disclosed: GitHub Security Advisory GHSA-xrp7-6w7g-q7fx published
- 2026-09-08: advisory: CVE-2026-86719 published on NVD