CVE-2026-114048: WWBN AVideo before 24.0 CSRF via Legacy Playlist and Video Endpoints

Q: Who is exposed to this issue?

WWBN AVideo deployments running a version before 24.0 are affected when users are logged in and can be induced to visit an attacker-controlled page. The attacker does not need the victim's credentials, but the victim must have permissions for the requested playlist or video action.

Q: What does an attacker need to exploit it?

An attacker needs to lure a logged-in user into loading a page containing an auto-submitting form that targets a vulnerable legacy endpoint. User interaction is required because the victim must visit that page.

Q: Which actions can be forged?

The described impact includes making private playlists public, removing videos from playlists, and forging video suggestions. The vulnerability affects legacy endpoints such as playlistStatus.php that bypass the .json.php-only autoCSRFGuard() check.

Q: What is the remediation?

Upgrade WWBN AVideo to version 24.0 or later. The affected range is versions before 24.0.

Published Oct 21, 2026

Updated

WWBN AVideo before 24.0 contains a cross-site request forgery vulnerability in legacy endpoints like playlistStatus.php that bypass the .json.php-only autoCSRFGuard() check. Attackers can lure logged-in users to a page with an auto-submitting form to make private playlists public, remove playlist videos, or forge video suggestions.

Affected Software

1 affected component

WWBN AVideo<24.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WWBN AVideo to a version that resolves this vulnerability.
Fixed in 24.0

Event History

Oct 21, 2026

CVE Published

via MITRE·12:36 AM

Data Sourced

via MITRE·12:36 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

WWBN AVideo deployments running a version before 24.0 are affected when users are logged in and can be induced to visit an attacker-controlled page. The attacker does not need the victim's credentials, but the victim must have permissions for the requested playlist or video action.

What does an attacker need to exploit it?

An attacker needs to lure a logged-in user into loading a page containing an auto-submitting form that targets a vulnerable legacy endpoint. User interaction is required because the victim must visit that page.

Which actions can be forged?

The described impact includes making private playlists public, removing videos from playlists, and forging video suggestions. The vulnerability affects legacy endpoints such as playlistStatus.php that bypass the .json.php-only autoCSRFGuard() check.

What is the remediation?

Upgrade WWBN AVideo to version 24.0 or later. The affected range is versions before 24.0.

CVE-2026-114048: WWBN AVideo before 24.0 CSRF via Legacy Playlist and Video Endpoints

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Which actions can be forged?

What is the remediation?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Which actions can be forged?

What is the remediation?