CVE-2026-81733: WWBN AVideo through 30.0 CSRF via myLiveControls.save.json.php
WWBN AVideo through 30.0 (and master up to commit 4cb576e) contains a cross-site request forgery vulnerability in plugin/Live/myLiveControls.save.json.php. The endpoint only checks that a user is logged in and processes customUrl, customMessage, and autoRedirect parameters from $REQUEST via a GET request without enforcing a CSRF token or origin check. An attacker who lures a logged-in streamer to a malicious page can silently change the live-channel viewer-redirect settings (persisted in users.externalOptions), causing viewers to be redirected to a phishing site or shown a spoofed message.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Logged-in streamers using affected WWBN AVideo installations are the direct target. Their live-channel viewer redirect settings can be changed, affecting people who subsequently view the channel.
What does an attacker need to exploit it?
The attacker needs to lure a logged-in streamer to a malicious page that sends a GET request to the vulnerable endpoint. No CSRF token or origin validation is required by the endpoint.
Are default deployments affected?
The issue is present in WWBN AVideo through 30.0 and in the master branch up to commit 4cb576e. Exposure depends on a logged-in user being able to access the Live plugin endpoint.
How can I tell whether settings may have been changed?
Review live-channel viewer-redirect settings, including customUrl, customMessage, and autoRedirect values stored in users.externalOptions. Unexpected redirect destinations or viewer messages, particularly phishing URLs or spoofed content, indicate possible impact.
What can be done if patching is not immediately possible?
Avoid visiting untrusted pages while logged in as a streamer, and review and correct live-channel redirect settings regularly. Restricting access to affected streamer accounts can reduce the opportunity for exploitation.