CVE-2026-40925
WWBN AVideo is an open source video platform.
Published Apr 21, 2026 · updated Jun 17, 2026 · wwbn avideo
WWBN AVideo is an open source video platform. In versions 29.0 and prior, (also routed via ) persists dozens of global site settings from but protects the endpoint only with . It does not call , does not verify a , and does not validate the Origin/Referer header. Because AVideo intentionally sets to support cross-origin iframe embedding, a logged-in administrator who visits an attacker-controlled page will have the browser auto-submit a cross-origin POST that rewrites the site's encoder URL, SMTP credentials, site HTML, logo, favicon, contact email, and more in a single request. Commit f9492f5e6123dff0292d5bb3164fde7665dc36b4 contains a fix.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Apr 21, 2026 · NIST NVD
Detected
WWBN AVideo is an open source video platform. In versions 29.0 and prior, (also routed via ) persists dozens of global site settings from but protects the endpoint only with . It does not call , does not verify a , and does not validate the Origin/Referer header. Because AVideo intentionally sets to support cross-origin iframe embedding, a logged-in administrator who visits an attacker-controlled
Jun 17, 2026 · NIST NVD
Updated
WWBN AVideo is an open source video platform. In versions 29.0 and prior, (also routed via ) persists dozens of global site settings from but protects the endpoint only with . It does not call , does not verify a , and does not validate the Origin/Referer header. Because AVideo intentionally sets to support cross-origin iframe embedding, a logged-in administrator who visits an attacker-controlled
Affected
- cpe wwbn/avideoversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-40925
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-40925
WWBN AVideo is an open source video platform. In versions 29.0 and prior, (also routed via ) persists dozens of global site settings from but protects the endpoint only with . It does not call `forbid
nvd.nist.gov