CVE-2026-58001: WWBN AVideo Cross-Site Request Forgery via videoEditLight.php
WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in objects/videoEditLight.php that lacks request authenticity checks and accepts GET requests. Attackers can store an img tag in a video description that transfers video ownership to an attacker-controlled account when an administrator views the video page.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
AVideo instances containing the affected code through commit 9c39d8c8 are exposed when administrators can view video pages whose descriptions may contain attacker-supplied HTML. The attack requires an administrator to view a page for a video carrying the malicious img tag.
What does an attacker need to exploit it?
An attacker needs an account with permission to edit a video description and must be able to place an img tag in that description. They also need an administrator to subsequently view the affected video page; no direct administrator interaction beyond viewing the page is described.
What is the impact after successful exploitation?
The attacker can cause ownership of the video to be transferred to an attacker-controlled account. The provided information identifies an integrity impact and does not describe confidentiality or availability effects.