CVE-2026-40928

WWBN AVideo is an open source video platform. In versions 29.0 and prior, multiple AVideo JSON endpoints under "objects/" accept state-changing requests via "$REQUEST"/"$GET" and persist changes tied to the caller's session user, without any anti-CSRF token, origin check, or referer check. A...