CVE-2026-35181

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the player skin configuration endpoint at admin/playerUpdate.json.php does not validate CSRF tokens. The plugins table is explicitly excluded from the ORM's domain-based security check via ignoreTableSecurityCheck(), removing the only other layer of defense. Combined with SameSite=None cookies, a cross-origin POST can modify the video player appearance on the entire platform.

• CWE-352

• https://github.com/WWBN/AVideo/security/advisories/GHSA-4q27-4rrq-fx95Exploit, Mitigation, Vendor Advisory
• https://github.com/WWBN/AVideo/security/advisories/GHSA-4q27-4rrq-fx95Exploit, Mitigation, Vendor Advisory

Published

Apr 6, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-35176openFPGALoader is a utility for programming FPGAs. In 1.1.1 …7.1
• CVE-2026-35177Vim is an open source, command line text editor. Prior to 9.…7.1
• CVE-2026-35178Workbench is a suite of tools for administrators and develop…9.8
• CVE-2026-35179WWBN AVideo is an open source video platform. In versions 26…5.3
• CVE-2026-3518OS Command Injection Remote Code Execution Vulnerability in …7.2
• CVE-2026-35180WWBN AVideo is an open source video platform. In versions 26…4.3
• CVE-2026-35182Brave CMS is an open-source CMS. Prior to 2.0.6, this vulner…8.8
• CVE-2026-35183Brave CMS is an open-source CMS. Prior to 2.0.6, an Insecure…5.4
• CVE-2026-35184EcclesiaCRM is CRM Software for church management. Prior to …9.8
• CVE-2026-35185HAX CMS helps manage microsite universe with PHP or NodeJs b…7.5
• CVE-2026-35186Wasmtime is a runtime for WebAssembly. From 25.0.0 to before…7.5
• CVE-2026-35187pyLoad is a free and open-source download manager written in…7.7