CVE-2026-34611 Details
Description
WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo endpoint objects/emailAllUsers.json.php allows administrators to send HTML emails to every registered user on the platform. While the endpoint verifies admin session status, it does not validate a CSRF token. Because AVideo sets SameSite=None on session cookies, a cross-origin POST request from an attacker-controlled page will include the admin's session cookie automatically. An attacker who lures an admin to a malicious page can send an arbitrary HTML email to every user on the platform, appearing to originate from the instance's legitimate SMTP address. At time of publication, there are no publicly available patches.
A cross-site request forgery (CSRF) vulnerability has been identified in WWBN AVideo versions through 26.0. The issue resides in the endpoint 'objects/emailAllUsers.json.php', which allows administrators to send HTML emails to all registered users on the platform. While the endpoint checks for admin status, it lacks proper CSRF token validation. AVideo's session cookies are set to 'SameSite=None', enabling cross-origin POST requests from attacker-controlled pages to include the admin's session cookie. This vulnerability can be exploited by luring an admin to a malicious page, thereby sending arbitrary HTML emails to all users, appearing to come from the platform's legitimate SMTP address.
To address this vulnerability, add CSRF token validation to the 'objects/emailAllUsers.json.php' endpoint, immediately after the admin check.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/WWBN/AVideo/security/advisories/GHSA-c4xj-x7p8-3x7q | CISA-ADP | ExploitVendor Advisory |
| https://github.com/WWBN/AVideo/security/advisories/GHSA-c4xj-x7p8-3x7q | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-352 | Cross-Site Request Forgery (CSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| wwbn avideo | <= 26.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 1, 2026 | Initial Analysis | [email protected] |
| Apr 1, 2026 | CVE Modified | CISA-ADP |
| Mar 31, 2026 | New CVE Received | [email protected] |