CVE-2026-34611 - Vulnerability Analysis

Overview

WWBN AVideo <= 26.0 contains a cross-site request forgery caused by missing CSRF token validation in objects/emailAllUsers.json.php endpoint, letting attackers send arbitrary HTML emails as admin, exploit requires admin to visit attacker page.

Severity & Score

Impact

Attackers can send arbitrary HTML emails to all users appearing from legitimate SMTP, enabling phishing or social engineering attacks.

Mitigation

Update to the latest version when patches become available.

References

• https://github.com/WWBN/AVideo/security/advisories/GHSA-c4xj-x7p8-3x7q

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner