CVE-2026-33649: Wwbn Avideo CSRF Vulnerability

CVE-2026-33649 Overview

WWBN AVideo is an open source video platform. A Cross-Site Request Forgery (CSRF) vulnerability exists in versions up to and including 26.0 that allows unauthenticated attackers to escalate privileges by exploiting the plugin/Permissions/setPermission.json.php endpoint. This endpoint accepts GET parameters for state-changing operations that modify user group permissions without CSRF token validation, and the application explicitly sets session.cookie_samesite=None on session cookies. An attacker can craft a malicious page with <img> tags that, when visited by an authenticated administrator, silently grants arbitrary permissions to the attacker's user group — effectively escalating the attacker to near-admin access.

Critical Impact
Unauthenticated attackers can achieve near-admin privilege escalation by tricking administrators into visiting malicious pages, potentially leading to full platform compromise.

Affected Products

WWBN AVideo versions up to and including 26.0
All AVideo installations using default session cookie configurations
Self-hosted AVideo instances without additional CSRF protections

Discovery Timeline

2026-03-23 - CVE CVE-2026-33649 published to NVD
2026-03-25 - Last updated in NVD database

Technical Details for CVE-2026-33649

Vulnerability Analysis

This vulnerability is classified as CWE-352 (Cross-Site Request Forgery). The core issue stems from two security misconfigurations working in tandem: the permission management endpoint performs state-changing operations via HTTP GET requests without validating CSRF tokens, and the application explicitly configures session cookies with SameSite=None. This combination creates a perfect storm for CSRF exploitation.

When an authenticated administrator visits an attacker-controlled webpage, embedded elements such as <img> tags can silently trigger GET requests to the vulnerable endpoint. Since the browser automatically includes session cookies (due to SameSite=None), these requests execute with the administrator's privileges, allowing the attacker to modify user group permissions arbitrarily.

Root Cause

The root cause is the absence of CSRF protection mechanisms on the plugin/Permissions/setPermission.json.php endpoint combined with an insecure session cookie configuration. The endpoint performs sensitive state-changing operations (modifying user permissions) using GET parameters instead of POST requests with anti-CSRF tokens. Additionally, the explicit session.cookie_samesite=None setting on session cookies defeats the browser's built-in CSRF protections that modern SameSite cookie defaults would otherwise provide.

Attack Vector

The attack is network-based and requires user interaction — specifically, an administrator must be lured to visit an attacker-controlled page while authenticated to the AVideo platform. The attacker constructs a malicious webpage containing <img> elements with src attributes pointing to the vulnerable endpoint with crafted parameters. When the administrator's browser loads these images, it automatically sends authenticated requests to the AVideo server, executing the permission changes without the administrator's knowledge or consent.

The vulnerability mechanism involves crafting malicious HTML elements that trigger GET requests to the setPermission.json.php endpoint. When an administrator visits the attacker's page, the browser loads these elements and sends authenticated requests due to the SameSite=None cookie configuration. For detailed technical information, see the GitHub Security Advisory.

Detection Methods for CVE-2026-33649

Indicators of Compromise

Unexpected permission changes in user groups or accounts without corresponding administrative action logs
Access logs showing GET requests to plugin/Permissions/setPermission.json.php with referrer headers from external domains
User groups gaining elevated permissions without documented authorization changes
Administrative accounts reporting they did not make permission modifications that appear in audit logs

Detection Strategies

Monitor web server access logs for requests to the setPermission.json.php endpoint with external or suspicious referrer headers
Implement alerts for permission changes that occur without corresponding entries in administrative activity logs
Review session logs for administrative accounts making requests from unexpected IP addresses or with unusual timing patterns
Deploy Web Application Firewall (WAF) rules to detect and block cross-origin requests to sensitive administrative endpoints

Monitoring Recommendations

Enable comprehensive logging for all permission-related API endpoints in the AVideo platform
Configure SIEM rules to correlate permission changes with legitimate administrative sessions
Establish baseline metrics for normal permission modification patterns and alert on deviations
Monitor for new or modified user groups with elevated privileges that were not created through documented processes

How to Mitigate CVE-2026-33649

Immediate Actions Required

Restrict access to the AVideo administrative interface to trusted IP addresses or VPN-only access
Implement network-level controls to limit external access to the plugin/Permissions/ directory
Advise administrators to use dedicated browser profiles for AVideo administration that are not used for general browsing
Review and audit all recent permission changes to identify any unauthorized modifications

Patch Information

As of the publication date, no known patched versions are available. Organizations should monitor the WWBN AVideo GitHub Security Advisory for updates on patch availability. Consider implementing additional security controls until an official fix is released.

Workarounds

Deploy a reverse proxy or WAF rule to validate the Referer and Origin headers for requests to permission management endpoints
Configure web server rules to block GET requests to setPermission.json.php from external referrers
Implement network segmentation to restrict administrative endpoint access to internal networks only
Use browser security extensions that restrict cross-origin requests when accessing the AVideo admin panel

bash

# Example Apache .htaccess configuration to restrict access to permissions endpoint
<Files "setPermission.json.php">
    # Allow only same-origin requests
    SetEnvIf Referer "^https://your-avideo-domain\.com" allowed_referer
    Order Deny,Allow
    Deny from all
    Allow from env=allowed_referer
</Files>