CVE-2026-34611

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-34611", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-30T17:15:52.500Z", "datePublished": "2026-03-31T20:42:37.985Z", "dateUpdated": "2026-04-01T13:39:27.793Z"}, "containers": {"cna": {"title": "AVideo: CSRF on emailAllUsers.json.php Enables Mass Phishing Email to All Users", "problemTypes": [{"descriptions": [{"cweId": "CWE-352", "lang": "en", "description": "CWE-352: Cross-Site Request Forgery (CSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/WWBN/AVideo/security/advisories/GHSA-c4xj-x7p8-3x7q", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-c4xj-x7p8-3x7q"}], "affected": [{"vendor": "WWBN", "product": "AVideo", "versions": [{"version": "<= 26.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-31T20:42:37.985Z"}, "descriptions": [{"lang": "en", "value": "WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo endpoint objects/emailAllUsers.json.php allows administrators to send HTML emails to every registered user on the platform. While the endpoint verifies admin session status, it does not validate a CSRF token. Because AVideo sets SameSite=None on session cookies, a cross-origin POST request from an attacker-controlled page will include the admin's session cookie automatically. An attacker who lures an admin to a malicious page can send an arbitrary HTML email to every user on the platform, appearing to originate from the instance's legitimate SMTP address. At time of publication, there are no publicly available patches."}], "source": {"advisory": "GHSA-c4xj-x7p8-3x7q", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-c4xj-x7p8-3x7q", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-01T13:39:23.605674Z", "id": "CVE-2026-34611", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-01T13:39:27.793Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-34611", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-01T13:39:23.605674Z"}}}], "references": [{"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-c4xj-x7p8-3x7q", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-01T13:39:18.344Z"}}], "cna": {"title": "AVideo: CSRF on emailAllUsers.json.php Enables Mass Phishing Email to All Users", "source": {"advisory": "GHSA-c4xj-x7p8-3x7q", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "WWBN", "product": "AVideo", "versions": [{"status": "affected", "version": "<= 26.0"}]}], "references": [{"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-c4xj-x7p8-3x7q", "name": "https://github.com/WWBN/AVideo/security/advisories/GHSA-c4xj-x7p8-3x7q", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo endpoint objects/emailAllUsers.json.php allows administrators to send HTML emails to every registered user on the platform. While the endpoint verifies admin session status, it does not validate a CSRF token. Because AVideo sets SameSite=None on session cookies, a cross-origin POST request from an attacker-controlled page will include the admin's session cookie automatically. An attacker who lures an admin to a malicious page can send an arbitrary HTML email to every user on the platform, appearing to originate from the instance's legitimate SMTP address. At time of publication, there are no publicly available patches."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352: Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-31T20:42:37.985Z"}}}, "cveMetadata": {"cveId": "CVE-2026-34611", "state": "PUBLISHED", "dateUpdated": "2026-04-01T13:39:27.793Z", "dateReserved": "2026-03-30T17:15:52.500Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-31T20:42:37.985Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "AVideo", "vendor": "WWBN", "versions": [{"status": "affected", "version": "<= 26.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*", "matchCriteriaId": "774C24F1-9D26-484F-B931-1DA107C8F588", "versionEndIncluding": "26.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo endpoint objects/emailAllUsers.json.php allows administrators to send HTML emails to every registered user on the platform. While the endpoint verifies admin session status, it does not validate a CSRF token. Because AVideo sets SameSite=None on session cookies, a cross-origin POST request from an attacker-controlled page will include the admin's session cookie automatically. An attacker who lures an admin to a malicious page can send an arbitrary HTML email to every user on the platform, appearing to originate from the instance's legitimate SMTP address. At time of publication, there are no publicly available patches."}, {"lang": "es", "value": "WWBN AVideo es una plataforma de video de c\u00f3digo abierto. En las versiones 26.0 y anteriores, el endpoint de AVideo objects/emailAllUsers.json.php permite a los administradores enviar correos electr\u00f3nicos HTML a cada usuario registrado en la plataforma. Aunque el endpoint verifica el estado de la sesi\u00f3n del administrador, no valida un token CSRF. Debido a que AVideo establece SameSite=None en las cookies de sesi\u00f3n, una solicitud POST de origen cruzado desde una p\u00e1gina controlada por un atacante incluir\u00e1 autom\u00e1ticamente la cookie de sesi\u00f3n del administrador. Un atacante que atrae a un administrador a una p\u00e1gina maliciosa puede enviar un correo electr\u00f3nico HTML arbitrario a cada usuario de la plataforma, pareciendo originarse de la direcci\u00f3n SMTP leg\u00edtima de la instancia. En el momento de la publicaci\u00f3n, no hay parches disponibles p\u00fablicamente."}], "id": "CVE-2026-34611", "lastModified": "2026-07-24T20:10:00.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34611", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-01T13:39:23.605674Z", "version": "2.0.3"}}]}, "published": "2026-03-31T21:16:31.297", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-c4xj-x7p8-3x7q"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-c4xj-x7p8-3x7q"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,26.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "AVideo", "source": "cna", "vendor": "WWBN"}, "product": "avideo", "vendor": "wwbn"}], "analysis": {"en": {"generated_at": "2026-04-02T04:53:24.566206+00:00", "value": {"mitigation_remediation": ["Verify whether a newer AVideo release exists; upgrade to the latest version if available.", "If an upgrade is unavailable, disable the objects/emailAllUsers.json.php endpoint or restrict it to localhost only.", "Configure the application to require a CSRF token for POST requests to this endpoint.", "Restrict administrative access to a secure network or VPN and monitor admin activity.", "Disable or limit the SMTP functionality that allows mass emailing to all users.", "Implement email filtering and user education to detect spoofed messages."], "summary": {"action": "Immediate Patch", "impact": "Mass phishing via CSRF"}, "threat_synthesis": {"affected_systems": "The affected product is WWBN AVideo, specifically the emailAllUsers.json.php endpoint available in all releases up to and including version 26.0. Any installation of AVideo 26.0 or older that has not applied a newer fix is vulnerable.", "description_and_impact": "In AVideo versions 26.0 and earlier, an endpoint that lets administrators send HTML emails to all users lacks CSRF protection. This allows an attacker to compel an admin to visit a malicious page and automatically submit a request that is authenticated with the admin\u2019s session cookie. The result is a spoofed mass email that appears to come from the platform\u2019s legitimate SMTP address, enabling large\u2011scale phishing attacks. The vulnerability does not give code execution or direct data access, but it undermines user trust and can lead to credential theft or further compromise through social engineering.", "risk_and_exploitability": "The CVSS score of 6.5 indicates a medium to high severity, while the EPSS score of less than 1% suggests that exploitation has not been widely observed. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is cross\u2011site request forgery; an attacker must lure an administrator to a malicious site that can trigger a POST request to the endpoint. Once an admin is compromised, the attacker can send arbitrary phishing emails to every user, potentially leading to credential compromise or malware delivery. Because the platform stores the admin session cookie with SameSite=None, the cookie is sent automatically by the browser, making the exploit trivial for anyone who can gain the admin\u2019s attention."}}}}, "created": "2026-04-02T07:52:28.705388+00:00", "updated": "2026-04-02T20:10:42.782847+00:00", "vendors": ["wwbn", "wwbn$PRODUCT$avideo"]}