Vulnerability · Published Aug 22, 2026 · Assigned by VulnCheck
CVE-2026-58003WWBN AVideo Cross-Site Request Forgery via releaseVideoNow.json.php
High 7.1
In plain English
A high-severity cross-site request forgery in AVideo from WWBN. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).
Severity (CVSS 3.1)7.1High
Exploit odds (30 days)0.1%top 97.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the releaseVideoNow.json.php endpoint that lacks authenticity checks and accepts GET requests. Attackers can craft a malicious cross-site GET request carrying an administrator's session cookie to permanently publish any embargoed video by manipulating the videos_id parameter.
Affected products (as reported)
Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
References
- GitHub Security Advisory (GHSA-q8cg-7x7q-c4g2) vendor-advisory
- VulnCheck Advisory: WWBN AVideo Cross-Site Request Forgery via releaseVideoNow.json.php third-party-advisory