CVE-2026-40928

WWBN AVideo is an open source video platform. In versions 29.0 and prior, multiple AVideo JSON endpoints under "objects/" accept state-changing requests via "$REQUEST"/"$GET" and persist changes tied to the caller's session user, without any anti-CSRF token, origin check, or referer check. A...

CVE-2026-40928: Cross-Site Request Forgery (CSRF)

WWBN AVideo is an open source video platform. In versions 29.0 and prior, multiple AVideo JSON endpoints under objects/ accept state-changing requests via $REQUEST/$GET and persist changes tied to the caller's session user, without any anti-CSRF token, origin check, or referer check. A malicious...