CVE-2026-34394

WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo's admin plugin configuration endpoint (admin/save.json.php) lacks any CSRF token validation. There is no call to isGlobalTokenValid() or verifyToken() before processing the request. Combined with the application's explicit SameSite=None cookie policy, an attacker can forge cross-origin POST requests from a malicious page to overwrite arbitrary plugin settings on a victim administrator's session. Because the plugins table is included in the ignoreTableSecurityCheck() array in objects/Object.php, standard table-level access controls are also bypassed. This allows a complete takeover of platform functionality by reconfiguring payment processors, authentication providers, cloud storage credentials, and more. At time of publication, there are no publicly available patches.

• CWE-352

• https://github.com/WWBN/AVideo/security/advisories/GHSA-4wwr-7h7c-chqrExploit, Vendor Advisory
• https://github.com/WWBN/AVideo/security/advisories/GHSA-4wwr-7h7c-chqrExploit, Vendor Advisory

Published

Mar 31, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-34389Fleet is open source device management software. Prior to 4.…6.5
• CVE-2026-3439A post-authentication Stack-based Buffer Overflow vulnerabil…4.9
• CVE-2026-34390Mantis Bug Tracker (MantisBT) is an open source issue tracke…5.1
• CVE-2026-34391Fleet is open source device management software. Prior to 4.…7.5
• CVE-2026-34392LORIS (Longitudinal Online Research and Imaging System) is a…7.5
• CVE-2026-34393Weblate is a web based localization tool. In versions prior …8.8
• CVE-2026-34395WWBN AVideo is an open source video platform. In versions 26…6.5
• CVE-2026-34396WWBN AVideo is an open source video platform. In versions 26…6.1
• CVE-2026-34397Himmelblau is an interoperability suite for Microsoft Azure …7
• CVE-2026-34400Alerta is a monitoring tool. Prior to version 9.1.0, the Que…9.8
• CVE-2026-34401XML Notepad is a Windows program that provides a simple intu…6.5
• CVE-2026-34402Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…