WWBN AVideo up to 29.0 JSON Endpoint comments_like.json.php cross-site request forgery

Summaryinfo

A vulnerability was found in WWBN AVideo up to 29.0. It has been declared as problematic. This affects an unknown part of the file objects/comments_like.json.php of the component JSON Endpoint. The manipulation results in cross-site request forgery. This vulnerability is reported as CVE-2026-40928. The attack can be launched remotely. No exploit exists. A patch should be applied to remediate this issue.

Detailsinfo

A vulnerability was found in WWBN AVideo up to 29.0. It has been classified as problematic. Affected is some unknown processing of the file objects/comments_like.json.php of the component JSON Endpoint. The manipulation with an unknown input leads to a cross-site request forgery vulnerability. CWE is classifying the issue as CWE-352. The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. This is going to have an impact on integrity. CVE summarizes:

WWBN AVideo is an open source video platform. In versions 29.0 and prior, multiple AVideo JSON endpoints under `objects/` accept state-changing requests via `$_REQUEST`/`$_GET` and persist changes tied to the caller's session user, without any anti-CSRF token, origin check, or referer check. A malicious page visited by a logged-in victim can silently cast/flip the victim's like/dislike on any comment (`objects/comments_like.json.php`), post a comment authored by the victim on any video, with attacker-chosen text (`objects/commentAddNew.json.php`), and/or delete assets from any category (`objects/categoryDeleteAssets.json.php`) when the victim has category management rights. Each endpoint is reachable from a browser via a simple `` tag or form submission, so exploitation only requires the victim to load an attacker-controlled HTML resource. Commit 7aaad601bd9cd7b993ba0ee1b1bea6c32ee7b77c contains a fix.

The advisory is available at github.com. This vulnerability is traded as CVE-2026-40928 since 04/15/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. Technical details are known, but there is no available exploit.

By approaching the search of inurl:objects/comments_like.json.php it is possible to find vulnerable targets with Google Hacking.

Applying the patch 7aaad601bd9cd7b993ba0ee1b1bea6c32ee7b77c is able to eliminate this problem. The bugfix is ready for download at github.com.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• WWBN

Name

• AVideo

Version

• 29.0

License

• open-source

Website

• Product: https://github.com/WWBN/AVideo/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion