CVE-2026-33649: Wwbn Avideo CSRF Vulnerability

CVE-2026-33649 Overview

WWBN AVideo is an open source video platform. A Cross-Site Request Forgery (CSRF) vulnerability exists in versions up to and including 26.0 that allows unauthenticated attackers to escalate privileges by exploiting the plugin/Permissions/setPermission.json.php endpoint. This endpoint accepts GET parameters for state-changing operations that modify user group permissions without CSRF token validation, and the application explicitly sets session.cookie_samesite=None on session cookies. An attacker can craft a malicious page with <img> tags that, when visited by an authenticated administrator, silently grants arbitrary permissions to the attacker's user group — effectively escalating the attacker to near-admin access.

Critical Impact

Unauthenticated attackers can achieve near-admin privilege escalation by tricking administrators into visiting malicious pages, potentially leading to full platform compromise.

Affected Products

• WWBN AVideo versions up to and including 26.0
• All AVideo installations using default session cookie configurations
• Self-hosted AVideo instances without additional CSRF protections

Discovery Timeline

• 2026-03-23 - CVE CVE-2026-33649 published to NVD
• 2026-03-25 - Last updated in NVD database

Technical Details for CVE-2026-33649

Vulnerability Analysis

This vulnerability is classified as CWE-352 (Cross-Site Request Forgery). The core issue stems from two security misconfigurations working in tandem: the permission management endpoint performs state-changing operations via HTTP GET requests without validating CSRF tokens, and the application explicitly configures session cookies with SameSite=None. This combination creates a perfect storm for CSRF exploitation.

When an authenticated administrator visits an attacker-controlled webpage, embedded elements such as <img> tags can silently trigger GET requests to the vulnerable endpoint. Since the browser automatically includes session cookies (due to SameSite=None), these requests execute with the administrator's privileges, allowing the attacker to modify user group permissions arbitrarily.

Root Cause

The root cause is the absence of CSRF protection mechanisms on the plugin/Permissions/setPermission.json.php endpoint combined with an insecure session cookie configuration. The endpoint performs sensitive state-changing operations (modifying user permissions) using GET parameters instead of POST requests with anti-CSRF tokens. Additionally, the explicit session.cookie_samesite=None setting on session cookies defeats the browser's built-in CSRF protections that modern SameSite cookie defaults would otherwise provide.

Attack Vector

The attack is network-based and requires user interaction — specifically, an administrator must be lured to visit an attacker-controlled page while authenticated to the AVideo platform. The attacker constructs a malicious webpage containing <img> elements with src attributes pointing to the vulnerable endpoint with crafted parameters. When the administrator's browser loads these images, it automatically sends authenticated requests to the AVideo server, executing the permission changes without the administrator's knowledge or consent.

The vulnerability mechanism involves crafting malicious HTML elements that trigger GET requests to the setPermission.json.php endpoint. When an administrator visits the attacker's page, the browser loads these elements and sends authenticated requests due to the SameSite=None cookie configuration. For detailed technical information, see the GitHub Security Advisory.

Detection Methods for CVE-2026-33649

Indicators of Compromise

• Unexpected permission changes in user groups or accounts without corresponding administrative action logs
• Access logs showing GET requests to plugin/Permissions/setPermission.json.php with referrer headers from external domains
• User groups gaining elevated permissions without documented authorization changes
• Administrative accounts reporting they did not make permission modifications that appear in audit logs

Detection Strategies

• Monitor web server access logs for requests to the setPermission.json.php endpoint with external or suspicious referrer headers
• Implement alerts for permission changes that occur without corresponding entries in administrative activity logs
• Review session logs for administrative accounts making requests from unexpected IP addresses or with unusual timing patterns
• Deploy Web Application Firewall (WAF) rules to detect and block cross-origin requests to sensitive administrative endpoints

Monitoring Recommendations

• Enable comprehensive logging for all permission-related API endpoints in the AVideo platform
• Configure SIEM rules to correlate permission changes with legitimate administrative sessions
• Establish baseline metrics for normal permission modification patterns and alert on deviations
• Monitor for new or modified user groups with elevated privileges that were not created through documented processes

How to Mitigate CVE-2026-33649

Immediate Actions Required

• Restrict access to the AVideo administrative interface to trusted IP addresses or VPN-only access
• Implement network-level controls to limit external access to the plugin/Permissions/ directory
• Advise administrators to use dedicated browser profiles for AVideo administration that are not used for general browsing
• Review and audit all recent permission changes to identify any unauthorized modifications

Patch Information

As of the publication date, no known patched versions are available. Organizations should monitor the WWBN AVideo GitHub Security Advisory for updates on patch availability. Consider implementing additional security controls until an official fix is released.

Workarounds

• Deploy a reverse proxy or WAF rule to validate the Referer and Origin headers for requests to permission management endpoints
• Configure web server rules to block GET requests to setPermission.json.php from external referrers
• Implement network segmentation to restrict administrative endpoint access to internal networks only
• Use browser security extensions that restrict cross-origin requests when accessing the AVideo admin panel

# Example Apache .htaccess configuration to restrict access to permissions endpoint
<Files "setPermission.json.php">
    # Allow only same-origin requests
    SetEnvIf Referer "^https://your-avideo-domain\.com" allowed_referer
    Order Deny,Allow
    Deny from all
    Allow from env=allowed_referer
</Files>