CVE-2026-40926
WWBN AVideo is an open source video platform.
Published Apr 21, 2026 · updated Jun 17, 2026 · wwbn avideo
WWBN AVideo is an open source video platform. In versions 29.0 and prior, three admin-only JSON endpoints — , , and — enforce only a role check ( / ) and perform state-changing actions against the database without calling or . Peer endpoints in the same directory ( , ) do enforce the CSRF token, so the missing checks are an omission rather than a design choice. An attacker who lures a logged-in admin to a malicious page can create, update, or delete categories and force execution of any installed plugin's method in the admin's session. Commit ee5615153c40628ab3ec6fe04962d1f92e67d3e2 contains a fix.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Apr 21, 2026 · NIST NVD
Detected
WWBN AVideo is an open source video platform. In versions 29.0 and prior, three admin-only JSON endpoints — , , and — enforce only a role check ( / ) and perform state-changing actions against the database without calling or . Peer endpoints in the same directory ( , ) do enforce the CSRF token, so the missing checks are an omission rather than a design choice. An attacker who lures a logged-in ad
Jun 17, 2026 · NIST NVD
Updated
WWBN AVideo is an open source video platform. In versions 29.0 and prior, three admin-only JSON endpoints — , , and — enforce only a role check ( / ) and perform state-changing actions against the database without calling or . Peer endpoints in the same directory ( , ) do enforce the CSRF token, so the missing checks are an omission rather than a design choice. An attacker who lures a logged-in ad
Affected
- cpe wwbn/avideoversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-40926
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-40926
WWBN AVideo is an open source video platform. In versions 29.0 and prior, three admin-only JSON endpoints — , , and — enforce only a role check (`Category::canCreateCategory
nvd.nist.gov