CVE-2026-86719: WWBN AVideo CustomizeUser Cross-Site Request Forgery Session Hijacking
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 (master) contains a cross-site request forgery vulnerability in the CustomizeUser plugin endpoint plugin/CustomizeUser/swapUser.json.php. The endpoint takes usersid from $REQUEST and invokes User::swapUser() without calling forbidIfNotPost() or forbidIfInvalidToken(), and the global autoCSRFGuard() check only runs for POST requests to .json.php, so the action is reachable via GET. An attacker who causes an authenticated administrator's browser to issue a cross-origin GET (for example via an <img> tag or link) can replace that administrator's session with a non-admin user account, causing the administrator to lose administrative access until the swap is cancelled; swapping to another administrator account is rejected, so this is not privilege escalation. The JSON response also discloses the sessionid. The CustomizeUser plugin is enabled by default, and no patch was available at the time of publication.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WWBN AVideo CustomizeUser plugin (plugin/CustomizeUser/swapUser.json.php)to a version that resolves this vulnerability.Patch c3edcc274c389816d434acadac07ee78eaf330c1 - Configuration
Update the swapUser endpoint so it rejects non-POST requests and requires a valid CSRF token by calling forbidIfNotPost() and forbidIfInvalidToken(); do not rely on autoCSRFGuard limited to POST *.json.php requests.
plugin/CustomizeUser/swapUser.json.php Request method handling / CSRF enforcement (forbidIfNotPost, forbidIfInvalidToken, autoCSRFGuard applicability) = Require POST and enforce forbidIfNotPost() and forbidIfInvalidToken() for the swapUser endpoint; ensure CSRF validation applies to this endpoint regardless of being invoked via GET - Compensating control
Mitigate impact by preventing cross-origin requests from reaching the vulnerable endpoint (e.g., restrict access to the endpoint using network/ACL/WAF rules so that only the intended site’s origin can call it).
Event History
Frequently Asked Questions
Are installations affected without enabling an optional feature?
Yes. The CustomizeUser plugin is enabled by default, so installations using the affected code are exposed unless that plugin has been disabled.
What must an attacker do to trigger the issue?
The attacker must cause an authenticated administrator's browser to make a cross-origin GET request to the affected endpoint, such as through an image tag or link. No attacker authentication is required, but administrator interaction with attacker-controlled content is needed.
What is the practical impact on the administrator account?
The administrator's session can be swapped to a non-administrator user account, causing loss of administrative access until the swap is cancelled. Swapping to another administrator account is rejected, so the issue does not provide privilege escalation.
Is a fix available?
No patch was available at the time of publication. The provided data does not identify an alternative mitigation beyond avoiding exposure through the enabled CustomizeUser functionality.