CVE-2026-34611

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo endpoint objects/emailAllUsers.json.php allows administrators to send HTML emails to every registered user on the platform. While the endpoint verifies admin session status, it does not validate a CSRF token. Because AVideo sets SameSite=None on session cookies, a cross-origin POST request from an attacker-controlled page will include the admin's session cookie automatically. An attacker who lures an admin to a malicious page can send an arbitrary HTML email to every user on the platform, appearing to originate from the instance's legitimate SMTP address. At time of publication, there are no publicly available patches.

• CWE-352

• https://github.com/WWBN/AVideo/security/advisories/GHSA-c4xj-x7p8-3x7qExploit, Vendor Advisory
• https://github.com/WWBN/AVideo/security/advisories/GHSA-c4xj-x7p8-3x7qExploit, Vendor Advisory

Published

Mar 31, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-34605SiYuan is a personal knowledge management system. From versi…6.1
• CVE-2026-34606Frappe Learning Management System (LMS) is a learning system…6.1
• CVE-2026-34607Emlog is an open source website building system. In versions…7.2
• CVE-2026-34608NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging …8.2
• CVE-2026-3461The Visa Acceptance Solutions plugin for WordPress is vulner…9.8
• CVE-2026-34610The leancrypto library is a cryptographic library that exclu…5.9
• CVE-2026-34612Kestra is an open-source, event-driven orchestration platfor…9
• CVE-2026-34613WWBN AVideo is an open source video platform. In versions 26…6.5
• CVE-2026-34614Adobe Connect versions 2025.3, 12.10 and earlier are affecte…6.1
• CVE-2026-34615Adobe Connect versions 2025.3, 12.10 and earlier are affecte…9.3
• CVE-2026-34617Adobe Connect versions 2025.3, 12.10 and earlier are affecte…8.7
• CVE-2026-34618Illustrator versions 30.2, 29.8.5 and earlier are affected b…7.8