CVE-2026-40928

WWBN AVideo is an open source video platform. In versions 29.0 and prior, multiple AVideo JSON endpoints under "objects/" accept state-changing requests via "$REQUEST"/"$GET" and persist changes tied to the caller's session user, without any anti-CSRF token, origin check, or referer check. A...

CVE-2026-40928: Cross-Site Request Forgery (CSRF)

WWBN AVideo is an open source video platform. In versions 29.0 and prior, multiple AVideo JSON endpoints under objects/ accept state-changing requests via $REQUEST/$GET and persist changes tied to the caller's session user, without any anti-CSRF token, origin check, or referer check. A malicious...

PT-2026-35128

Summary Multiple AVideo JSON endpoints under objects/ accept state-changing requests via $ REQUEST/$ GET and persist changes tied to the caller's session user, without any anti-CSRF token, origin check, or referer check. A malicious page visited by a logged-in victim can silently: 1. Cast/flip th...