Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
Sources: National Vulnerability Database, CISA KEV, Exploit-DB
CVE-2026-114048 Overview
CVE-2026-114048 is a Cross-Site Request Forgery (CSRF) vulnerability in WWBN AVideo versions prior to 24.0. The flaw affects legacy endpoints such as playlistStatus.php that bypass the autoCSRFGuard() check, which is scoped only to .json.php endpoints. An attacker can lure an authenticated user to a page containing an auto-submitting form, triggering unintended state changes on the victim's account. Successful exploitation lets attackers flip private playlists to public, remove videos from playlists, or forge video suggestions on behalf of the authenticated user. The weakness is tracked under CWE-352.
Critical Impact
Authenticated users visiting attacker-controlled pages can have playlist privacy, playlist contents, and video suggestion state modified without consent.
Affected Products
- WWBN AVideo versions prior to 24.0
- Legacy endpoint playlistStatus.php
- Additional legacy video and playlist endpoints not protected by autoCSRFGuard()
Discovery Timeline
- 2026-10-21 - CVE-2026-114048 published to NVD
- 2026-10-22 - Last updated in NVD database
Technical Details for CVE-2026-114048
Vulnerability Analysis
AVideo implements CSRF protection through an autoCSRFGuard() helper. The guard is enforced only for endpoints matching the .json.php naming convention. Legacy PHP endpoints such as playlistStatus.php fall outside that pattern and execute state-changing operations without validating an anti-CSRF token or verifying the request origin. Attackers who host a malicious page can embed hidden forms or image tags targeting these endpoints. When an authenticated AVideo user visits that page, the browser automatically attaches session cookies and submits the forged request. The server executes the action as the victim, enabling unauthorized changes to playlist visibility, playlist membership, and video suggestion state.
Root Cause
The root cause is incomplete coverage of the CSRF defense. The autoCSRFGuard() middleware was applied only to the newer .json.php API surface, leaving legacy .php handlers that still perform mutating actions without any token check. This is a classic missing authorization control for cross-origin requests, mapped to CWE-352.
Attack Vector
Exploitation requires network access, an authenticated victim session, and user interaction such as visiting a crafted page or clicking a malicious link. The attacker crafts an HTML page that auto-submits a form to a vulnerable legacy endpoint on the target AVideo instance. Because no token or origin check is enforced, the server treats the request as legitimate. See the GitHub Security Advisory and VulnCheck Advisory for AVideo CSRF for technical details.
Detection Methods for CVE-2026-114048
Indicators of Compromise
- Unexpected playlist visibility changes from private to public without a corresponding user-initiated action in application logs.
- Playlist item removals or video suggestion submissions originating from HTTP requests whose Referer or Origin header does not match the AVideo host.
- POST requests to playlistStatus.php or other legacy .php endpoints that carry a valid session cookie but no CSRF token parameter.
Detection Strategies
- Inspect web server access logs for POST requests to legacy endpoints such as playlistStatus.php with cross-origin Referer values.
- Correlate authenticated user session activity with sudden bursts of playlist or suggestion state changes outside normal usage patterns.
- Monitor for repeated identical state-changing requests across multiple user sessions, which can indicate a mass CSRF campaign.
Monitoring Recommendations
- Enable verbose application logging for all AVideo endpoints that mutate playlist or video state, capturing Referer, Origin, and session identifiers.
- Forward web and application logs to a centralized analytics platform for cross-session correlation and anomaly detection.
- Alert on legacy endpoint usage once the upgrade to AVideo 24.0 is complete, since continued traffic may indicate unpatched clients or attack probes.
How to Mitigate CVE-2026-114048
Immediate Actions Required
- Upgrade WWBN AVideo to version 24.0 or later, which extends CSRF protection to the affected legacy endpoints.
- Audit application logs for recent state changes on playlists and video suggestions, and notify affected users where tampering is suspected.
- Review any custom plugins or forks that reuse legacy endpoint patterns to ensure they enforce CSRF tokens.
Patch Information
The fix is tracked in the GitHub Security Advisory for the WWBN/AVideo project. Operators should deploy AVideo 24.0 or newer, which applies CSRF enforcement across both .json.php and legacy .php endpoints. Additional context is available in the VulnCheck Advisory for AVideo CSRF.
Workarounds
- Place AVideo behind a reverse proxy or web application firewall rule that blocks POST requests to legacy endpoints when the Origin or Referer header does not match the application host.
- Configure the session cookie with SameSite=Lax or SameSite=Strict to prevent browsers from attaching credentials to cross-site POST requests.
- Restrict access to administrative and playlist-management endpoints by IP allowlist where feasible until the upgrade is deployed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
Sources: National Vulnerability Database, CISA KEV, Exploit-DB
