CVE-2026-92579 Details
Description
In AVideo through 29.0, the autoCSRFGuard() function maintains a hardcoded allowlist of exempt basenames tested without directory context, allowing plugin files matching core filenames to inherit CSRF exemptions. The LoginWordPress plugin file login.json.php inherits an exemption and unconditionally logs out authenticated users on cross-site POST requests before validating credentials.
A Cross-Site Request Forgery (CSRF) vulnerability has been identified in AVideo versions through 29.0, specifically within the LoginWordPress plugin. The issue arises because the autoCSRFGuard() function maintains a hardcoded allowlist of exempt basenames, which is applied without directory context. This flaw allows plugin files that match core filenames to inherit CSRF exemptions. The vulnerable file, login.json.php, unconditionally logs out authenticated users on cross-site POST requests, before validating credentials, creating a potential for session hijacking.
It is recommended to update the autoCSRFGuard() function to match the allowlist based on the path relative to the web root, rather than just the basename. Additionally, the 'login.json.php' file should be modified to log out users only after successfully authenticating them.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 16, 2026CISA-ADP
Assessed Sep 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/WWBN/AVideo/security/advisories/GHSA-3hg6-6x7m-5xr8 | CISA-ADP | AdvisoryExploitTechnical AnalysisVendor |
| https://github.com/WWBN/AVideo/security/advisories/GHSA-3hg6-6x7m-5xr8 | [email protected] | AdvisoryExploitTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/avideo-through-29.0-broken-access-control-via-csrf-exemption-basename-collision | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-289 | Authentication Bypass by Alternate Name | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| WWBN AVideo | <= 29.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 18, 2026 | CVE Modified | CISA-ADP |
| Sep 16, 2026 | New CVE Received | [email protected] |