CVE-2026-86719

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 master contains a cross-site request forgery vulnerability in the CustomizeUser plugin endpoint plugin/CustomizeUser/swapUser.json.php. The endpoint takes usersid from $REQUEST and invokes User::swapUser without calling...

CVE-2026-86719

WWBN AVideo through commit c3edcc274c (master) is affected by a cross-site request forgery (CSRF) vulnerability in the CustomizeUser plugin at the endpoint plugin/CustomizeUser/swapUser.json.php. The endpoint reads users_id from $_REQUEST and calls User::swapUser() without CSRF protection, as the...

EUVD-2026-72855

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 master contains a cross-site request forgery vulnerability in the CustomizeUser plugin endpoint plugin/CustomizeUser/swapUser.json.php. The endpoint takes usersid from $REQUEST and invokes User::swapUser without calling...

CVE-2026-33297 AVideo has an IDOR - Any Admin Can Set Another User's Channel Password via setPassword.json.php

WWBN AVideo is an open source video platform. Prior to version 26.0, the setPassword.json.php endpoint in the CustomizeUser plugin allows administrators to set a channel password for any user. Due to a logic error in how the submitted password value is processed, any password containing non-numer...

CVE-2026-33297

WWBN AVideo is an open source video platform. Prior to version 26.0, the setPassword.json.php endpoint in the CustomizeUser plugin allows administrators to set a channel password for any user. Due to a logic error in how the submitted password value is processed, any password containing non-numer...

AVideo: IDOR - Any Admin Can Set Another User's Channel Password Via SetPassword.json.php

Summary The "setPassword.json.php" endpoint in the CustomizeUser plugin allows administrators to set a channel password for any user. Due to a logic error in how the submitted password value is processed, any password containing non-numeric characters is silently coerced to the integer zero befor...

PT-2026-26475

Summary The setPassword.json.php endpoint in the CustomizeUser plugin allows administrators to set a channel password for any user. Due to a logic error in how the submitted password value is processed, any password containing non-numeric characters is silently coerced to the integer zero before...