CVE-2026-35180: WWBN AVideo CSRF Vulnerability

CVE-2026-35180 Overview

WWBN AVideo is an open source video platform that contains a Cross-Site Request Forgery (CSRF) vulnerability in versions 26.0 and prior. The site customization endpoint at admin/customize_settings_nativeUpdate.json.php lacks CSRF token validation and writes uploaded logo files to disk before the ORM's domain-based security check executes. Combined with a SameSite=None cookie policy, a cross-origin POST request can overwrite the platform's logo with attacker-controlled content.

Critical Impact

Attackers can leverage this CSRF vulnerability to overwrite platform branding assets with malicious content, potentially enabling phishing attacks, defacement, or delivery of malicious payloads to platform users.

Affected Products

• WWBN AVideo version 26.0 and prior

Discovery Timeline

• 2026-04-06 - CVE-2026-35180 published to NVD
• 2026-04-07 - Last updated in NVD database

Technical Details for CVE-2026-35180

Vulnerability Analysis

This vulnerability is classified as Cross-Site Request Forgery (CWE-352), affecting the administrative customization functionality of the WWBN AVideo platform. The vulnerable endpoint allows administrators to upload custom logo files to personalize the video platform's appearance.

The core issue stems from a race condition in the file processing pipeline combined with missing CSRF protections. When a logo upload request is received, the application writes the uploaded file to disk immediately—before the ORM's domain-based security validation has an opportunity to verify the request's legitimacy. This creates a window during which unauthorized content can be persisted to the server.

The vulnerability's exploitability is significantly enhanced by the platform's use of SameSite=None for authentication cookies. This cookie configuration allows browsers to send credentials on cross-origin requests, meaning an attacker-hosted page can trigger authenticated actions on the AVideo platform without additional user interaction beyond visiting the malicious site.

Root Cause

The root cause involves two interconnected security failures. First, the customize_settings_nativeUpdate.json.php endpoint processes file uploads without validating CSRF tokens, meaning any cross-origin request that includes valid session cookies will be accepted as legitimate. Second, the file write operation occurs before authorization checks complete, creating a time-of-check to time-of-use (TOCTOU) vulnerability where the file is persisted regardless of subsequent security validations.

Attack Vector

An attacker can exploit this vulnerability by crafting a malicious web page that automatically submits a POST request to the AVideo customization endpoint when visited by an authenticated administrator. The attack requires no special tools or elevated privileges—only that the victim has an active session on the target AVideo instance and visits the attacker-controlled page.

The attacker crafts a form that targets the vulnerable endpoint with a multipart POST request containing a malicious logo file. When an authenticated AVideo administrator visits this page, their browser automatically includes session cookies due to the SameSite=None policy, and the server processes the upload as a legitimate administrative action.

For detailed technical information, see the GitHub Security Advisory.

Detection Methods for CVE-2026-35180

Indicators of Compromise

• Unexpected changes to platform logo or branding assets in the AVideo installation
• Access logs showing POST requests to admin/customize_settings_nativeUpdate.json.php with external referrer headers
• Logo files with unexpected content types or embedded scripts
• Server-side file modification timestamps that don't correlate with legitimate administrative activity

Detection Strategies

• Monitor HTTP access logs for cross-origin requests to administrative customization endpoints, particularly those with Origin or Referer headers pointing to external domains
• Implement file integrity monitoring for static assets in the AVideo web directory to detect unauthorized modifications
• Review web application firewall logs for POST requests to admin endpoints lacking expected CSRF token parameters
• Configure alerting for authentication events followed by customization changes from different IP addresses or geographic locations

Monitoring Recommendations

• Enable detailed logging on the AVideo administrative panel to track all customization changes with associated session information
• Deploy web application firewall rules to block multipart form submissions to admin endpoints from external referrers
• Implement content security policy (CSP) headers to restrict form submission targets and prevent exfiltration
• Monitor for rapid succession of admin authentication and file upload events that may indicate automated exploitation

How to Mitigate CVE-2026-35180

Immediate Actions Required

• Review all custom logo and branding files on existing AVideo installations for unauthorized modifications
• Restrict access to the administrative panel by IP address or VPN until the platform can be updated
• Configure web server rules to block POST requests to customize_settings_nativeUpdate.json.php from external referrers
• Audit recent administrative access logs for signs of exploitation

Patch Information

At the time of this advisory, WWBN AVideo versions 26.0 and prior are affected. Organizations should monitor the GitHub Security Advisory for patch releases and upgrade instructions.

Workarounds

• Implement reverse proxy rules to require CSRF token validation before forwarding requests to the customization endpoint
• Modify the application's session cookie configuration to use SameSite=Strict or SameSite=Lax to prevent cross-origin credential transmission
• Disable the native logo customization feature by removing or restricting access to the vulnerable PHP file
• Deploy a web application firewall with CSRF protection rules for administrative endpoints

# Apache .htaccess configuration to restrict access to vulnerable endpoint
<Files "customize_settings_nativeUpdate.json.php">
    # Block requests without matching origin
    SetEnvIf Origin "^https?://your-avideo-domain\.com$" ORIGIN_OK=1
    Order deny,allow
    Deny from all
    Allow from env=ORIGIN_OK
    
    # Alternatively, restrict to local/trusted IPs only
    # Allow from 192.168.1.0/24
</Files>