CVE-2026-40929 json
WWBN AVideo's missing CSRF protection in objects/commentDelete.json.php enables mass comment deletion against moderators and content creators
published 2026-04-14 6 mo ago modified 2026-10-26 13 d ago also GHSA-8qm8-g55h-xmqr , EUVD-2026-24525
- cvss
- 5.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.1%
- EPSS 0.1% chance of exploitation in 30 days, percentile 1%
- public exploits
- 0
- none known
Summary
WWBN AVideo is an open source video platform. In versions 29.0 and prior, `objects/commentDelete.json.php` is a state-mutating JSON endpoint that deletes comments but performs no CSRF validation. It does not call `forbidIfIsUntrustedRequest()`, does not verify a CSRF/global token, and does not check `Origin`/`Referer`. Because AVideo intentionally sets `session.cookie_samesite=None` (to support cross-origin embed players), a cross-site request from any attacker-controlled page automatically carries the victim's `PHPSESSID`. Any authenticated victim who has authority to delete one or more comments (site moderators, video owners, and comment authors) can be tricked into deleting comments en masse simply by visiting an attacker page. Commit 184f36b1896f3364f864f17c1acca3dd8df3af27 contains a fix.
Patch / fix
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 6 mo ago
Exploit prediction
0.11% chance of exploitation in the next 30 days, higher than 1% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/WWBN/AVideo/security/advisories/GHSA-8qm8-g55h-xmqr referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L |
| GitHub | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | wwbn/avideo | <=29.0 |
no fix listed |
Affected products
- WWBN AVideo
Classification
- Weakness
-
- CWE-352 Cross-Site Request Forgery
References
-
github.com
/WWBN/AVideo/commit/184f36b1896f3364f864f17c1acca3dd8df3af27
web, patch
-
github.com
/WWBN/AVideo/security/advisories/GHSA-8qm8-g55h-xmqr
exploit, web, mitigation, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-40929
advisory
-
github.com
/WWBN/AVideo
package
Sources
- CVE List CVE-2026-40929
- GitHub Advisory GHSA-8qm8-g55h-xmqr
- NVD CVE-2026-40929
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.