CVE-2026-34394 - Vulnerability Analysis

Overview

WWBN AVideo <= 26.0 contains a cross-site request forgery caused by lack of CSRF token validation in admin plugin configuration endpoint, letting attackers overwrite plugin settings via cross-origin POST requests, exploit requires victim administrator session.

Severity & Score

Impact

Attackers can fully take over platform functionality by reconfiguring critical settings via forged requests.

Mitigation

Implement CSRF token validation in admin plugin configuration endpoint or update to a version that includes this fix when available.

References

• https://github.com/WWBN/AVideo/security/advisories/GHSA-4wwr-7h7c-chqr

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner