Vulnerability · Published Aug 22, 2026 · Assigned by VulnCheck

CVE-2026-57944AVideo channelToGallery.json.php Cross-Site Request Forgery

Medium 5.4

In plain English

A medium-severity cross-site request forgery in AVideo from WWBN. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.1%top 98.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in channelToGallery.json.php that allows attackers to modify site-wide Gallery configuration by performing unauthorized writes to plugin data. Attackers can craft a cross-site GET request carrying an administrator's session cookie to promote arbitrary channels to the front page or delete curated sections without token validation.

Affected products (as reported)

Vendor	Product	Versions
WWBN	AVideo	0 – through 9c39d8c8b4c1f75540788d6b391740852ceb0732

Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

References

GitHub Security Advisory (GHSA-8qq4-h7xj-p2c4) vendor-advisory
VulnCheck Advisory: AVideo channelToGallery.json.php Cross-Site Request Forgery third-party-advisory