CVE-2026-40926 - Vulnerability Analysis

Overview

WWBN AVideo <= 29.0 contains a cross-site request forgery caused by missing CSRF token validation in admin-only JSON endpoints, letting attackers force category changes and plugin update script execution via a logged-in admin, exploit requires admin user interaction.

Severity & Score

Impact

Attackers can manipulate categories and execute plugin update scripts with admin privileges, potentially compromising the system.

Mitigation

Update to the fixed version containing commit ee5615153c40628ab3ec6fe04962d1f92e67d3e2 or later.

References

• https://github.com/WWBN/AVideo/commit/ee5615153c40628ab3ec6fe04962d1f92e67d3e2
• https://github.com/WWBN/AVideo/security/advisories/GHSA-ffw8-fwxp-h64w

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner