WWBN AVideo: Missing CSRF Protection on State-Changing JSON Endpoints Enables Forced Comment Creation, Vote Manipulation, and Category Asset Deletion

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

5.4 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

EPSS

• CVE-2026-40928: 0.11% estimated exploitation activity in the next 30 days; percentile 1.57 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Summary Multiple AVideo JSON endpoints under objects/ accept state-changing requests via $REQUEST/$GET and persist changes tied to the caller's session user, without any anti-CSRF token, origin check, or referer check. A malicious page visited by a logged-in victim can silently: 1. Cast/flip the victim's like/dislike on any comment (objects/commentslike.json.php). 2. Post a comment authored by the victim on any video, with attacker-chosen text (objects/commentAddNew.json.php). 3. Delete assets from any category (objects/categoryDeleteAssets.json.php) when the victim has category management rights. Each endpoint is reachable from a browser via a simple <img src="…" tag or form submission, so exploitation only requires the victim to load an attacker-controlled HTML resource. Details AVideo exposes a helper, forbidIfIsUntrustedRequest() (objects/functionsSecurity.php:138), that rejects cross-origin requests when the Referer/Origin does not match webSiteRootURL. It is only invoked in one…

Published by the source

14 Apr 2026, 23:12 UTC

Last modified by the source

24 Apr 2026, 20:32 UTC

Source last checked

26 Oct 2026, 14:39 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-x2pw-9c38-cp2j

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2026-40928

Advisory: WWBN AVideo: Missing CSRF Protection on State-Changing JSON Endpoints Enables Forced Comment Creation, Vote Manipulation, and Category Asset Deletion
IDs: CVE-2026-40928, GHSA-x2pw-9c38-cp2j
Record: https://patchnext.com/advisories/cve-2026-40928 (revision 1, source checked 26 Oct 2026, 14:39 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Medium (CVSS 5.4)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor response not established. A vendor fix does not mean a deployment is fixed.

## Affected components
- Packagist wwbn/avideo: affected <= 29.0

## Suggested inspection (read-only)
- Packagist wwbn/avideo: check the installed version with your package manager.

## Supported action
No complete vendor fix is recorded. Follow the primary source's mitigation guidance and check this record again before closing anything.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on wwbn/avideo.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-x2pw-9c38-cp2j (GitHub-reviewed advisory GHSA-x2pw-9c38-cp2j lists affected ranges: Packagist wwbn/avideo >=0 <=29.0)

Commands are suggestions: review each one before running it.