CVE-2026-34394: Wwbn Avideo CSRF Vulnerability

CVE-2026-34394 Overview

CVE-2026-34394 is a Cross-Site Request Forgery (CSRF) vulnerability affecting WWBN AVideo, an open source video platform. The vulnerability exists in the admin plugin configuration endpoint (admin/save.json.php) which lacks any CSRF token validation. There is no call to isGlobalTokenValid() or verifyToken() before processing the request. Combined with the application's explicit SameSite=None cookie policy, an attacker can forge cross-origin POST requests from a malicious page to overwrite arbitrary plugin settings on a victim administrator's session.

Critical Impact

This vulnerability allows complete takeover of platform functionality by reconfiguring payment processors, authentication providers, cloud storage credentials, and more through forged requests targeting authenticated administrators.

Affected Products

• WWBN AVideo versions 26.0 and prior
• All installations using the default admin plugin configuration endpoint
• Deployments with SameSite=None cookie policy (default configuration)

Discovery Timeline

• 2026-03-31 - CVE CVE-2026-34394 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-34394

Vulnerability Analysis

The vulnerability stems from the complete absence of CSRF protection on the administrative plugin configuration endpoint. When an administrator is authenticated to the AVideo platform, their session cookies are automatically sent with any request to the application due to the SameSite=None cookie policy. This creates a dangerous scenario where malicious websites can craft requests that appear legitimate to the AVideo server.

The admin/save.json.php endpoint processes plugin configuration changes without validating that the request originated from a legitimate source within the application. The application does have CSRF protection mechanisms available (isGlobalTokenValid() and verifyToken()), but these are simply not called before processing configuration changes.

Compounding this issue, the plugins table is explicitly included in the ignoreTableSecurityCheck() array in objects/Object.php, which means standard table-level access controls are also bypassed for plugin-related operations. This design decision effectively removes an additional layer of defense that might otherwise limit the impact of the CSRF vulnerability.

Root Cause

The root cause of this vulnerability is the missing implementation of CSRF token validation in the admin plugin configuration endpoint. The admin/save.json.php file does not invoke the available CSRF protection functions before processing incoming requests. Additionally, the permissive SameSite=None cookie configuration allows cross-origin requests to include authentication cookies, and the security bypass for the plugins table in ignoreTableSecurityCheck() eliminates potential fallback protections.

Attack Vector

An attacker can exploit this vulnerability by crafting a malicious webpage that submits a forged POST request to the victim's AVideo installation. The attack requires the victim administrator to visit the malicious page while authenticated to their AVideo instance. The attack is network-based and does not require any authentication or special privileges from the attacker's perspective—only user interaction (visiting the malicious page) is needed.

The attacker can manipulate critical platform settings including payment processor configurations, authentication provider settings, cloud storage credentials, and other plugin parameters. This could lead to credential theft, financial fraud, or complete platform compromise.

Since no verified code examples are available for this vulnerability, technical details can be found in the GitHub Security Advisory.

Detection Methods for CVE-2026-34394

Indicators of Compromise

• Unexpected changes to plugin configurations in the AVideo admin panel
• Configuration modifications to payment processors, authentication providers, or cloud storage settings without administrator action
• Web server logs showing POST requests to admin/save.json.php with Referer headers from external domains
• User reports of suspicious redirects or credential prompts after visiting external websites

Detection Strategies

• Monitor web server access logs for POST requests to admin/save.json.php originating from external referrers
• Implement Web Application Firewall (WAF) rules to detect and block cross-origin requests to administrative endpoints
• Review AVideo audit logs for plugin configuration changes and correlate with administrator activity
• Deploy browser-based security tools to detect potential CSRF attacks on administrative sessions

Monitoring Recommendations

• Enable detailed logging for all administrative endpoint access in AVideo
• Set up alerts for plugin configuration changes, especially those affecting payment or authentication settings
• Monitor for unusual patterns of administrative requests that may indicate automated CSRF exploitation
• Implement network-level monitoring to detect connections from known malicious domains

How to Mitigate CVE-2026-34394

Immediate Actions Required

• Restrict access to AVideo administrative interfaces to trusted networks only
• Implement a Web Application Firewall (WAF) with CSRF protection rules
• Advise administrators to use dedicated browser sessions for AVideo administration and avoid visiting untrusted websites while authenticated
• Consider implementing additional authentication requirements for sensitive configuration changes

Patch Information

At the time of publication, there are no publicly available patches for this vulnerability. Organizations should monitor the GitHub Security Advisory for updates regarding official fixes from WWBN.

Workarounds

• Implement network-level access controls to restrict administrative endpoint access to trusted IP addresses only
• Deploy a reverse proxy with CSRF protection capabilities in front of the AVideo installation
• Configure the web server to reject requests to admin/save.json.php with external Referer headers
• Use browser extensions or policies that enforce stricter cookie handling for administrative sessions

# Example: Apache configuration to restrict admin access by IP
<Location /admin>
    Require ip 192.168.1.0/24
    Require ip 10.0.0.0/8
</Location>

# Example: Nginx configuration to check Referer header
location /admin/save.json.php {
    if ($http_referer !~ "^https://your-avideo-domain\.com") {
        return 403;
    }
}