CVE-2026-58003: WWBN AVideo Cross-Site Request Forgery via releaseVideoNow.json.php
WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the releaseVideoNow.json.php endpoint that lacks authenticity checks and accepts GET requests. Attackers can craft a malicious cross-site GET request carrying an administrator's session cookie to permanently publish any embargoed video by manipulating the videosid parameter.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WWBN AVideoto a version that resolves this vulnerability.Patch commit 9c39d8c8
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Instances running an affected WWBN AVideo version through commit 9c39d8c8 are exposed when an administrator has an active authenticated session and can be induced to load attacker-controlled content.
What does an attacker need to exploit it?
The attacker does not need an account or administrator credentials. They need to cause an authenticated administrator's browser to send a crafted cross-site GET request to releaseVideoNow.json.php with a chosen videos_id value.
What is the impact if exploitation succeeds?
A successful request can permanently publish an embargoed video selected through the videos_id parameter. The provided severity vector indicates high confidentiality impact and low integrity impact, with no availability impact.
How can I assess whether my deployment is affected?
Check whether the deployment includes releaseVideoNow.json.php and is at or before commit 9c39d8c8. The vulnerable behavior is that the endpoint accepts GET requests and lacks authenticity checks for the video-release action.