CVE-2026-86718: WWBN AVideo Cross-Site Request Forgery via deleteHistory.json.php
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in deleteHistory.json.php and finishAll.json.php that allows unauthenticated attackers to mutate live history by making GET requests without CSRF token validation. Attackers can craft malicious pages that trigger administrator browsers to delete all live transmission history or mark streams as finished when an admin visits the attacker-controlled site.
Affected Software
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
An attacker must lure an administrator into visiting an attacker-controlled page. That page can cause the administrator's browser to send GET requests to the affected endpoints without CSRF token validation.
What actions can be triggered through the vulnerable endpoints?
The issue can delete all live transmission history through deleteHistory.json.php or mark streams as finished through finishAll.json.php. The impact is integrity loss and limited availability impact rather than disclosure of data.
Who is exposed?
Administrators using a WWBN AVideo instance containing the affected code are exposed when they visit attacker-controlled content while authenticated to the instance. The attacker does not need prior privileges or authentication.
How can I determine whether my installation is affected?
Review whether the installation includes commit c3edcc274c389816d434acadac07ee78eaf330c1 and whether deleteHistory.json.php or finishAll.json.php accept state-changing GET requests without CSRF token validation.