WWBN AVideo is an open source video platform. In versions 26.0 and prior, the player skin configuration endpoint at admin/playerUpdate.json.php does not validate CSRF tokens. The plugins table is explicitly excluded from the ORM's domain-based security check via ignoreTableSecurityCheck(), removing the only other layer of defense. Combined with SameSite=None cookies, a cross-origin POST can modify the video player appearance on the entire platform.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 Github GHSA |
GHSA-4q27-4rrq-fx95 | AVideo: CSRF on Player Skin Configuration via admin/playerUpdate.json.php |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Mon, 06 Apr 2026 20:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | WWBN AVideo is an open source video platform. In versions 26.0 and prior, the player skin configuration endpoint at admin/playerUpdate.json.php does not validate CSRF tokens. The plugins table is explicitly excluded from the ORM's domain-based security check via ignoreTableSecurityCheck(), removing the only other layer of defense. Combined with SameSite=None cookies, a cross-origin POST can modify the video player appearance on the entire platform. | |
| Title | WWBN AVideo Affected by CSRF on Player Skin Configuration via admin/playerUpdate.json.php | |
| Weaknesses | CWE-352 | |
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-04-06T19:09:45.204Z
Reserved: 2026-04-01T17:26:21.133Z
Link: CVE-2026-35181
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-04-06T20:16:26.393
Modified: 2026-04-06T20:16:26.393
Link: CVE-2026-35181
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses