CVE-2026-45610 Details

A cross-site request forgery (CSRF) vulnerability has been identified in WWBN AVideo versions 29.0 and earlier, specifically within the two-factor authentication (2FA) toggle feature. The vulnerability resides in the `plugin/LoginControl/set.json.php` file, where the endpoint accepts POST requests to disable 2FA for the session-authenticated user. The absence of CSRF protection, such as a validation token or re-authentication requirement, allows an attacker to exploit this vulnerability by sending a cross-origin request that disables the victim's 2FA without their knowledge. This exploitation could be achieved through a hidden form or a fetch request that omits credentials, effectively silencing the action while compromising the account's security by removing the 2FA safeguard.

To address this vulnerability, it is recommended to add CSRF protection to the 2FA toggle endpoint, similar to other state-changing endpoints in the AVideo codebase. Additionally, when disabling 2FA, users should be required to provide the current 2FA code or undergo a password re-authentication process.