WWBN AVideo up to 29.0 JSON Endpoint categoryAddNew.json.php canCreateCategory cross-site request forgery

Summaryinfo

A vulnerability categorized as problematic has been discovered in WWBN AVideo up to 29.0. This issue affects the function Category::canCreateCategory of the file objects/categoryAddNew.json.php of the component JSON Endpoint. Such manipulation leads to cross-site request forgery. This vulnerability is traded as CVE-2026-40926. The attack may be launched remotely. There is no exploit available. It is advisable to implement a patch to correct this issue.

Detailsinfo

A vulnerability was found in WWBN AVideo up to 29.0. It has been rated as problematic. Affected by this issue is the function Category::canCreateCategory of the file objects/categoryAddNew.json.php of the component JSON Endpoint. The manipulation with an unknown input leads to a cross-site request forgery vulnerability. Using CWE to declare the problem leads to CWE-352. The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. Impacted is integrity. CVE summarizes:

WWBN AVideo is an open source video platform. In versions 29.0 and prior, three admin-only JSON endpoints — `objects/categoryAddNew.json.php`, `objects/categoryDelete.json.php`, and `objects/pluginRunUpdateScript.json.php` — enforce only a role check (`Category::canCreateCategory()` / `User::isAdmin()`) and perform state-changing actions against the database without calling `isGlobalTokenValid()` or `forbidIfIsUntrustedRequest()`. Peer endpoints in the same directory (`pluginSwitch.json.php`, `pluginRunDatabaseScript.json.php`) do enforce the CSRF token, so the missing checks are an omission rather than a design choice. An attacker who lures a logged-in admin to a malicious page can create, update, or delete categories and force execution of any installed plugin's `updateScript()` method in the admin's session. Commit ee5615153c40628ab3ec6fe04962d1f92e67d3e2 contains a fix.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-40926 since 04/15/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available.

By approaching the search of inurl:objects/categoryAddNew.json.php it is possible to find vulnerable targets with Google Hacking.

Applying the patch ee5615153c40628ab3ec6fe04962d1f92e67d3e2 is able to eliminate this problem. The bugfix is ready for download at github.com.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• WWBN

Name

• AVideo

Version

• 29.0

License

• open-source

Website

• Product: https://github.com/WWBN/AVideo/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion