WWBN AVideo CSRF Token Validation view/logArchive.json.php cross-site request forgery

Summaryinfo

A vulnerability classified as problematic has been found in WWBN AVideo. This impacts an unknown function of the file view/logArchive.json.php of the component CSRF Token Validation. This manipulation causes cross-site request forgery. This vulnerability is tracked as CVE-2026-88873. The attack is possible to be carried out remotely. No exploit exists. Applying a patch is the recommended action to fix this issue.

Detailsinfo

A vulnerability was found in WWBN AVideo (version now known). It has been declared as problematic. Affected by this vulnerability is some unknown processing of the file view/logArchive.json.php of the component CSRF Token Validation. The manipulation with an unknown input leads to a cross-site request forgery vulnerability. The CWE definition for the vulnerability is CWE-352. The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. As an impact it is known to affect integrity. The summary by CVE is:

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in view/logArchive.json.php that allows unauthenticated attackers to archive application logs by making GET requests without CSRF token validation. Attackers can craft malicious pages that trigger administrators' browsers to request the endpoint, copying sensitive application logs to a publicly accessible zip file and truncating the live log to remove forensic evidence.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-88873 since 09/10/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available.

By approaching the search of inurl:view/logArchive.json.php it is possible to find vulnerable targets with Google Hacking.

Applying the patch c3edcc274c389816d434acadac07ee78eaf330c1 is able to eliminate this problem.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• WWBN

Name

• AVideo

License

• open-source

Website

• Product: https://github.com/WWBN/AVideo/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion