CVE-2026-34394

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-34394", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-27T13:45:29.619Z", "datePublished": "2026-03-31T20:39:45.781Z", "dateUpdated": "2026-04-01T13:40:10.738Z"}, "containers": {"cna": {"title": "AVideo: CSRF on Admin Plugin Configuration Enables Payment Credential Hijacking", "problemTypes": [{"descriptions": [{"cweId": "CWE-352", "lang": "en", "description": "CWE-352: Cross-Site Request Forgery (CSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/WWBN/AVideo/security/advisories/GHSA-4wwr-7h7c-chqr", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-4wwr-7h7c-chqr"}], "affected": [{"vendor": "WWBN", "product": "AVideo", "versions": [{"version": "<= 26.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-31T20:39:45.781Z"}, "descriptions": [{"lang": "en", "value": "WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo's admin plugin configuration endpoint (admin/save.json.php) lacks any CSRF token validation. There is no call to isGlobalTokenValid() or verifyToken() before processing the request. Combined with the application's explicit SameSite=None cookie policy, an attacker can forge cross-origin POST requests from a malicious page to overwrite arbitrary plugin settings on a victim administrator's session. Because the plugins table is included in the ignoreTableSecurityCheck() array in objects/Object.php, standard table-level access controls are also bypassed. This allows a complete takeover of platform functionality by reconfiguring payment processors, authentication providers, cloud storage credentials, and more. At time of publication, there are no publicly available patches."}], "source": {"advisory": "GHSA-4wwr-7h7c-chqr", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-4wwr-7h7c-chqr", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-01T13:40:07.414516Z", "id": "CVE-2026-34394", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-01T13:40:10.738Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-34394", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-01T13:40:07.414516Z"}}}], "references": [{"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-4wwr-7h7c-chqr", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-01T13:39:57.867Z"}}], "cna": {"title": "AVideo: CSRF on Admin Plugin Configuration Enables Payment Credential Hijacking", "source": {"advisory": "GHSA-4wwr-7h7c-chqr", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "WWBN", "product": "AVideo", "versions": [{"status": "affected", "version": "<= 26.0"}]}], "references": [{"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-4wwr-7h7c-chqr", "name": "https://github.com/WWBN/AVideo/security/advisories/GHSA-4wwr-7h7c-chqr", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo's admin plugin configuration endpoint (admin/save.json.php) lacks any CSRF token validation. There is no call to isGlobalTokenValid() or verifyToken() before processing the request. Combined with the application's explicit SameSite=None cookie policy, an attacker can forge cross-origin POST requests from a malicious page to overwrite arbitrary plugin settings on a victim administrator's session. Because the plugins table is included in the ignoreTableSecurityCheck() array in objects/Object.php, standard table-level access controls are also bypassed. This allows a complete takeover of platform functionality by reconfiguring payment processors, authentication providers, cloud storage credentials, and more. At time of publication, there are no publicly available patches."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352: Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-31T20:39:45.781Z"}}}, "cveMetadata": {"cveId": "CVE-2026-34394", "state": "PUBLISHED", "dateUpdated": "2026-04-01T13:40:10.738Z", "dateReserved": "2026-03-27T13:45:29.619Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-31T20:39:45.781Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "AVideo", "vendor": "WWBN", "versions": [{"status": "affected", "version": "<= 26.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*", "matchCriteriaId": "774C24F1-9D26-484F-B931-1DA107C8F588", "versionEndIncluding": "26.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo's admin plugin configuration endpoint (admin/save.json.php) lacks any CSRF token validation. There is no call to isGlobalTokenValid() or verifyToken() before processing the request. Combined with the application's explicit SameSite=None cookie policy, an attacker can forge cross-origin POST requests from a malicious page to overwrite arbitrary plugin settings on a victim administrator's session. Because the plugins table is included in the ignoreTableSecurityCheck() array in objects/Object.php, standard table-level access controls are also bypassed. This allows a complete takeover of platform functionality by reconfiguring payment processors, authentication providers, cloud storage credentials, and more. At time of publication, there are no publicly available patches."}, {"lang": "es", "value": "WWBN AVideo es una plataforma de video de c\u00f3digo abierto. En las versiones 26.0 y anteriores, el endpoint de configuraci\u00f3n del plugin de administraci\u00f3n de AVideo (admin/save.json.php) carece de cualquier validaci\u00f3n de token CSRF. No hay ninguna llamada a isGlobalTokenValid() o verifyToken() antes de procesar la solicitud. Combinado con la pol\u00edtica de cookie expl\u00edcita SameSite=None de la aplicaci\u00f3n, un atacante puede forjar solicitudes POST de origen cruzado desde una p\u00e1gina maliciosa para sobrescribir configuraciones arbitrarias de plugins en la sesi\u00f3n de un administrador v\u00edctima. Debido a que la tabla de plugins est\u00e1 incluida en el array ignoreTableSecurityCheck() en objects/Object.php, los controles de acceso est\u00e1ndar a nivel de tabla tambi\u00e9n son eludidos. Esto permite una toma de control completa de la funcionalidad de la plataforma reconfigurando procesadores de pago, proveedores de autenticaci\u00f3n, credenciales de almacenamiento en la nube y m\u00e1s. En el momento de la publicaci\u00f3n, no hay parches disponibles p\u00fablicamente."}], "id": "CVE-2026-34394", "lastModified": "2026-07-24T20:10:00.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34394", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-01T13:40:07.414516Z", "version": "2.0.3"}}]}, "published": "2026-03-31T21:16:30.660", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-4wwr-7h7c-chqr"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-4wwr-7h7c-chqr"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,26.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "AVideo", "source": "cna", "vendor": "WWBN"}, "product": "avideo", "vendor": "wwbn"}], "analysis": {"en": {"generated_at": "2026-04-02T05:21:07.863328+00:00", "value": {"mitigation_remediation": ["Temporarily enforce a stricter SameSite cookie policy (Lax or Strict) for the admin session to block cross\u2011origin POST requests", "Restrict the admin interface to trusted IPs or a WAF that blocks POSTs to /admin/save.json.php from external origins", "Monitor the plugins table for unauthorized changes and alert administrators immediately", "If feasible, modify admin/save.json.php to include a CSRF token validation (e.g., call verifyToken() or isGlobalTokenValid()) before processing configuration changes", "Keep the system updated and monitor WWBN\u2019s repository for any official fix, applying it as soon as it becomes available"], "summary": {"action": "Apply Workaround", "impact": "Privilege Escalation leading to full administrative takeover and payment credential compromise"}, "threat_synthesis": {"affected_systems": "Every installation of WWBN AVideo running version 26.0 or earlier is affected, because the vulnerability resides in the admin/save.json.php endpoint and the application\u2019s SameSite=None cookie policy.", "description_and_impact": "A flawed CSRF validation in AVideo\u2019s admin plugin configuration endpoint allows an attacker to forge cross\u2011origin POST requests that overwrite any plugin setting. By bypassing normal token checks and the table\u2011level security guard, the attacker gains ability to reconfigure payment processors, authentication providers, and cloud storage credentials, effectively taking control of the platform.", "risk_and_exploitability": "The CVSS Base Score of 8.1 indicates high severity. The EPSS score of less than 1\u202f% suggests limited current exploitation, and the issue is not in the CISA KEV catalog. The attack requires an attacker to host a malicious page that a logged\u2011in administrator visits while the session cookie is present. The forged request is then accepted without validation, giving the attacker full administrative capabilities. Until a vendor patch is released, the risk remains significant for any site that uses third\u2011party payment or storage services."}}}}, "created": "2026-04-02T07:52:30.611688+00:00", "updated": "2026-04-02T20:10:44.673588+00:00", "vendors": ["wwbn", "wwbn$PRODUCT$avideo"]}