Vulnerability · Published Mar 31, 2026 · Assigned by GitHub_M

CVE-2026-34613AVideo: CSRF on Plugin Enable/Disable Endpoint Allows Disabling Security Plugins

Medium 6.5

In plain English

A medium-severity cross-site request forgery in AVideo from WWBN. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.2%top 89.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo endpoint objects/pluginSwitch.json.php allows administrators to enable or disable any installed plugin. The endpoint checks for an active admin session but does not validate a CSRF token. Additionally, the plugins database table is explicitly listed in ignoreTableSecurityCheck(), which means the ORM-level Referer/Origin domain validation in ObjectYPT::save() is also bypassed. Combined with SameSite=None on session cookies, an attacker can disable critical security plugins (such as LoginControl for 2FA, subscription enforcement, or access control plugins) by luring an admin to a malicious page. At time of publication, there are no publicly available patches.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	wwbn/avideo	no fix listed	GHSA-hqxf-mhfw-rc44

Affected products (as reported)

Vendor	Product	Versions
WWBN	AVideo	<= 26.0

Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-hqxf-mhfw-rc44 x_refsource_CONFIRM