CVE-2026-43880

WWBN AVideo is an open source video platform. In versions up to and including 29.0, objects/sendEmail.json.php exposes two branches depending on whether contactForm=1 is submitted. When the parameter is omitted, the endpoint sets $sendTo to an attacker-supplied email and, for unauthenticated callers, uses the site's own contact email as the message From:/Reply-To:. The endpoint is explicitly allow-listed as a "public write action" in objects/functionsSecurity.php (line 885), so it requires no authentication or CSRF token. An unauthenticated attacker (solving a captcha) can force the site's own SMTP infrastructure to send attacker-composed emails to arbitrary recipients with the site's legitimate sender address, passing SPF/DKIM/DMARC for the site's domain — ideal for targeted phishing and brand impersonation. Commit 4e3709895857a5857f0edb46b0ee984de0d9e1a2 contains an updated fix.

• CWE-940

• https://github.com/WWBN/AVideo/commit/4e3709895857a5857f0edb46b0ee984de0d9e1a2
• https://github.com/WWBN/AVideo/security/advisories/GHSA-5hgj-7gm9-cff5
• https://github.com/WWBN/AVideo/security/advisories/GHSA-5hgj-7gm9-cff5

Published

May 11, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-43875WWBN AVideo is an open source video platform. In versions up…6.8
• CVE-2026-43876WWBN AVideo is an open source video platform. In versions up…6.4
• CVE-2026-43877WWBN AVideo is an open source video platform. In versions up…5.4
• CVE-2026-43878WWBN AVideo is an open source video platform. In versions up…6.1
• CVE-2026-43879WWBN AVideo is an open source video platform. In versions up…5.4
• CVE-2026-4388The Form Maker by 10Web plugin for WordPress is vulnerable t…7.2
• CVE-2026-43881WWBN AVideo is an open source video platform. In versions up…5.3
• CVE-2026-43882WWBN AVideo is an open source video platform. In versions up…4.3
• CVE-2026-43883WWBN AVideo is an open source video platform. In versions up…4.2
• CVE-2026-43884WWBN AVideo is an open source video platform. In versions up…7.7
• CVE-2026-43885WWBN AVideo is an open source video platform. In versions up…7.7
• CVE-2026-43886Outline is a service that allows for collaborative documenta…8.2