CVE-2026-40928

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-40928", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-15T20:40:15.517Z", "datePublished": "2026-04-21T22:14:15.472Z", "dateUpdated": "2026-04-22T13:15:43.678Z"}, "containers": {"cna": {"title": "AVideo: Missing CSRF Protection on State-Changing JSON Endpoints Enables Forced Comment Creation, Vote Manipulation, and Category Asset Deletion", "problemTypes": [{"descriptions": [{"cweId": "CWE-352", "lang": "en", "description": "CWE-352: Cross-Site Request Forgery (CSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/WWBN/AVideo/security/advisories/GHSA-x2pw-9c38-cp2j", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-x2pw-9c38-cp2j"}, {"name": "https://github.com/WWBN/AVideo/commit/7aaad601bd9cd7b993ba0ee1b1bea6c32ee7b77c", "tags": ["x_refsource_MISC"], "url": "https://github.com/WWBN/AVideo/commit/7aaad601bd9cd7b993ba0ee1b1bea6c32ee7b77c"}], "affected": [{"vendor": "WWBN", "product": "AVideo", "versions": [{"version": "<= 29.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-21T22:14:15.472Z"}, "descriptions": [{"lang": "en", "value": "WWBN AVideo is an open source video platform. In versions 29.0 and prior, multiple AVideo JSON endpoints under `objects/` accept state-changing requests via `$_REQUEST`/`$_GET` and persist changes tied to the caller's session user, without any anti-CSRF token, origin check, or referer check. A malicious page visited by a logged-in victim can silently cast/flip the victim's like/dislike on any comment (`objects/comments_like.json.php`), post a comment authored by the victim on any video, with attacker-chosen text (`objects/commentAddNew.json.php`), and/or delete assets from any category (`objects/categoryDeleteAssets.json.php`) when the victim has category management rights. Each endpoint is reachable from a browser via a simple `<img src=\"\u2026\">` tag or form submission, so exploitation only requires the victim to load an attacker-controlled HTML resource. Commit 7aaad601bd9cd7b993ba0ee1b1bea6c32ee7b77c contains a fix."}], "source": {"advisory": "GHSA-x2pw-9c38-cp2j", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-x2pw-9c38-cp2j", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-22T13:15:40.914548Z", "id": "CVE-2026-40928", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-22T13:15:43.678Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-40928", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-22T13:15:40.914548Z"}}}], "references": [{"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-x2pw-9c38-cp2j", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-22T13:15:36.019Z"}}], "cna": {"title": "AVideo: Missing CSRF Protection on State-Changing JSON Endpoints Enables Forced Comment Creation, Vote Manipulation, and Category Asset Deletion", "source": {"advisory": "GHSA-x2pw-9c38-cp2j", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "WWBN", "product": "AVideo", "versions": [{"status": "affected", "version": "<= 29.0"}]}], "references": [{"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-x2pw-9c38-cp2j", "name": "https://github.com/WWBN/AVideo/security/advisories/GHSA-x2pw-9c38-cp2j", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/WWBN/AVideo/commit/7aaad601bd9cd7b993ba0ee1b1bea6c32ee7b77c", "name": "https://github.com/WWBN/AVideo/commit/7aaad601bd9cd7b993ba0ee1b1bea6c32ee7b77c", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "WWBN AVideo is an open source video platform. In versions 29.0 and prior, multiple AVideo JSON endpoints under `objects/` accept state-changing requests via `$_REQUEST`/`$_GET` and persist changes tied to the caller's session user, without any anti-CSRF token, origin check, or referer check. A malicious page visited by a logged-in victim can silently cast/flip the victim's like/dislike on any comment (`objects/comments_like.json.php`), post a comment authored by the victim on any video, with attacker-chosen text (`objects/commentAddNew.json.php`), and/or delete assets from any category (`objects/categoryDeleteAssets.json.php`) when the victim has category management rights. Each endpoint is reachable from a browser via a simple `<img src=\"\u2026\">` tag or form submission, so exploitation only requires the victim to load an attacker-controlled HTML resource. Commit 7aaad601bd9cd7b993ba0ee1b1bea6c32ee7b77c contains a fix."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352: Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-21T22:14:15.472Z"}}}, "cveMetadata": {"cveId": "CVE-2026-40928", "state": "PUBLISHED", "dateUpdated": "2026-04-22T13:15:43.678Z", "dateReserved": "2026-04-15T20:40:15.517Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-21T22:14:15.472Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "AVideo", "vendor": "WWBN", "versions": [{"status": "affected", "version": "<= 29.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*", "matchCriteriaId": "AC38CA07-71C1-4C86-B84A-83CF96367CBA", "versionEndIncluding": "29.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "WWBN AVideo is an open source video platform. In versions 29.0 and prior, multiple AVideo JSON endpoints under `objects/` accept state-changing requests via `$_REQUEST`/`$_GET` and persist changes tied to the caller's session user, without any anti-CSRF token, origin check, or referer check. A malicious page visited by a logged-in victim can silently cast/flip the victim's like/dislike on any comment (`objects/comments_like.json.php`), post a comment authored by the victim on any video, with attacker-chosen text (`objects/commentAddNew.json.php`), and/or delete assets from any category (`objects/categoryDeleteAssets.json.php`) when the victim has category management rights. Each endpoint is reachable from a browser via a simple `<img src=\"\u2026\">` tag or form submission, so exploitation only requires the victim to load an attacker-controlled HTML resource. Commit 7aaad601bd9cd7b993ba0ee1b1bea6c32ee7b77c contains a fix."}, {"lang": "es", "value": "WWBN AVideo es una plataforma de video de c\u00f3digo abierto. En las versiones 29.0 y anteriores, m\u00faltiples endpoints JSON de AVideo bajo \u201cobjects/\u201d aceptan solicitudes que cambian el estado a trav\u00e9s de \u201c$_REQUEST\u201d/\u201c$_GET\u201d y persisten los cambios vinculados al usuario de la sesi\u00f3n del llamante, sin ning\u00fan token anti-CSRF, verificaci\u00f3n de origen o verificaci\u00f3n de referer. Una p\u00e1gina maliciosa visitada por una v\u00edctima que ha iniciado sesi\u00f3n puede silenciosamente emitir/cambiar el \u2019me gusta\u2019/\u2019no me gusta\u2019 de la v\u00edctima en cualquier comentario (\u201cobjects/comments_like.json.php\u201d), publicar un comentario escrito por la v\u00edctima en cualquier video, con texto elegido por el atacante (\u201cobjects/commentAddNew.json.php\u201d), y/o eliminar activos de cualquier categor\u00eda (\u201cobjects/categoryDeleteAssets.json.php\u201d) cuando la v\u00edctima tiene derechos de gesti\u00f3n de categor\u00edas. Cada endpoint es accesible desde un navegador a trav\u00e9s de una simple etiqueta \u201c<img src=\u201c...\u201d>\u201d o env\u00edo de formulario, por lo que la explotaci\u00f3n solo requiere que la v\u00edctima cargue un recurso HTML controlado por el atacante. El commit 7aaad601bd9cd7b993ba0ee1b1bea6c32ee7b77c contiene una correcci\u00f3n."}], "id": "CVE-2026-40928", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40928", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-22T13:15:40.914548Z", "version": "2.0.3"}}]}, "published": "2026-04-21T23:16:20.300", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/WWBN/AVideo/commit/7aaad601bd9cd7b993ba0ee1b1bea6c32ee7b77c"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-x2pw-9c38-cp2j"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-x2pw-9c38-cp2j"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,29.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "AVideo", "source": "cna", "vendor": "WWBN"}, "product": "avideo", "vendor": "wwbn"}], "analysis": {"en": {"generated_at": "2026-04-22T06:17:25.543872+00:00", "value": {"mitigation_remediation": ["Upgrade WWBN AVideo to the latest release that incorporates commit 7aaad601bd9cd7b993ba0ee1b1bea6c32ee7b77c or higher.", "If an update is not immediately possible, use an application firewall or web\u2011server rule to block or require a valid CSRF token for requests to the affected JSON endpoints, rejecting any traffic that lacks proper referer or origin headers.", "As a temporary safeguard, revoke category\u2011management privileges from users that are not trusted administrators and disable user\u2011initiated comment posting or like features until the patch is applied."], "summary": {"action": "Immediate Patch", "impact": "Unauthorized state changes via CSRF"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the open\u2011source video platform WWBN AVideo up to and including version 29.0. The affected endpoints are located under the objects/ directory and include objects/comments_like.json.php, objects/commentAddNew.json.php, and objects/categoryDeleteAssets.json.php. No other vendors or products were listed.", "description_and_impact": "WWBN AVideo in versions 29.0 and earlier exposes several JSON endpoints that accept state\u2011changing requests using unfiltered GET or REQUEST parameters. These endpoints allow a logged\u2011in user\u2019s session to perform actions such as liking or disliking comments, posting new comments on behalf of the user, and deleting assets from categories where the user has management rights. Because no anti\u2011CSRF token, origin, or referer validation is performed, a malicious site can force the victim\u2019s browser to send these requests silently. This is a Cross\u2011Site Request Forgery (CWE-352) flaw, so the likely attack vector is a CSRF exploit when a victim visits an attacker\u2011controlled page that includes an image or form targeting one of the vulnerable URLs, causing the victim\u2019s credentials to be used without consent.", "risk_and_exploitability": "The CVSS score of 5.4 indicates a moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited publicly known exploitation at this time. Successful exploitation requires the victim to be authenticated within the application and simply load an attacker\u2011controlled page. Once triggered, the attacker can manipulate the victim\u2019s likes/dislikes, inject comments, or delete category assets, compromising data integrity and potentially causing unwanted user interactions or resource removal."}}}}, "created": "2026-04-22T04:30:05.160736+00:00", "updated": "2026-04-22T06:30:10.665206+00:00", "vendors": ["wwbn", "wwbn$PRODUCT$avideo"]}