CVE-2026-40925: WWBN AVideo has CSRF in configurationUpdate.json.php Enables Full Site Configuration Takeover Including Encoder URL and SMTP Credentials
WWBN AVideo is an open source video platform. In versions 29.0 and prior, objects/configurationUpdate.json.php (also routed via /updateConfig) persists dozens of global site settings from $POST but protects the endpoint only with User::isAdmin(). It does not call forbidIfIsUntrustedRequest(), does not verify a globalToken, and does not validate the Origin/Referer header. Because AVideo intentionally sets session.cookiesamesite=None to support cross-origin iframe embedding, a logged-in administrator who visits an attacker-controlled page will have the browser auto-submit a cross-origin POST that rewrites the site's encoder URL, SMTP credentials, site <head> HTML, logo, favicon, contact email, and more in a single request. Commit f9492f5e6123dff0292d5bb3164fde7665dc36b4 contains a fix.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40925?
CVE-2026-40925 is rated as a critical vulnerability due to its potential for full site configuration takeover.
How do I fix CVE-2026-40925?
To fix CVE-2026-40925, upgrade to AVideo version 30.0 or later where the vulnerability has been patched.
What types of attacks can CVE-2026-40925 facilitate?
CVE-2026-40925 can facilitate attacks that enable unauthorized access to sensitive configurations, including SMTP credentials and encoder URLs.
Which software versions are affected by CVE-2026-40925?
AVideo versions 29.0 and prior are affected by CVE-2026-40925.
What component of AVideo does CVE-2026-40925 exploit?
CVE-2026-40925 exploits the configurationUpdate.json.php file, allowing for CSRF attacks.