CVE-2026-40928 - Vulnerability Analysis

Overview

WWBN AVideo <= 29.0 contains a cross-site request forgery caused by lack of anti-CSRF tokens and origin checks in multiple JSON endpoints under objects/, letting attackers force logged-in users to perform state-changing actions like liking comments, posting comments, or deleting assets, exploit requires victim to load attacker-controlled HTML.

Severity & Score

Impact

Attackers can force logged-in users to perform unwanted actions, potentially leading to unauthorized content changes or asset deletions.

Mitigation

Update to a version including commit 7aaad601bd9cd7b993ba0ee1b1bea6c32ee7b77c or later

References

• https://github.com/WWBN/AVideo/commit/7aaad601bd9cd7b993ba0ee1b1bea6c32ee7b77c
• https://github.com/WWBN/AVideo/security/advisories/GHSA-x2pw-9c38-cp2j

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner