CVE-2026-40929 - Vulnerability Analysis

Overview

WWBN AVideo <= 29.0 contains a cross-site request forgery vulnerability caused by lack of CSRF validation in objects/commentDelete.json.php, letting authenticated users with delete authority be tricked into deleting comments via cross-site requests.

Severity & Score

Impact

Authenticated users with delete permissions can be tricked into deleting comments, leading to unauthorized data modification and disruption.

Mitigation

Update to the version including commit 184f36b1896f3364f864f17c1acca3dd8df3af27 or later.

References

• https://github.com/WWBN/AVideo/commit/184f36b1896f3364f864f17c1acca3dd8df3af27
• https://github.com/WWBN/AVideo/security/advisories/GHSA-8qm8-g55h-xmqr

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner