CVE-2026-40929: WWBN AVideo CSRF Vulnerability

CVE-2026-40929 Overview

CVE-2026-40929 is a Cross-Site Request Forgery (CSRF) vulnerability in WWBN AVideo, an open source video platform. The vulnerability exists in versions 29.0 and prior where the objects/commentDelete.json.php endpoint performs state-mutating operations (comment deletion) without implementing proper CSRF validation mechanisms.

The vulnerable endpoint fails to call forbidIfIsUntrustedRequest(), does not verify a CSRF/global token, and does not check Origin or Referer headers. This issue is compounded by the fact that AVideo intentionally configures session.cookie_samesite=None to support cross-origin embed players, which allows cross-site requests from attacker-controlled pages to automatically carry the victim's PHPSESSID session cookie.

Critical Impact

Any authenticated user with comment deletion privileges (site moderators, video owners, and comment authors) can be tricked into mass-deleting comments by simply visiting an attacker-controlled webpage.

Affected Products

• WWBN AVideo versions 29.0 and prior
• All installations with comment deletion functionality enabled
• Deployments using cross-origin embed players with session.cookie_samesite=None

Discovery Timeline

• 2026-04-21 - CVE CVE-2026-40929 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2026-40929

Vulnerability Analysis

This CSRF vulnerability arises from insufficient request validation in the comment deletion endpoint. The objects/commentDelete.json.php file processes deletion requests without verifying that the request originated from the legitimate AVideo application. The vulnerability allows attackers to craft malicious web pages that, when visited by authenticated AVideo users, automatically submit comment deletion requests on behalf of those users.

The exploitation is facilitated by AVideo's explicit configuration of session.cookie_samesite=None, which was implemented to support cross-origin video embedding functionality. While this configuration serves a legitimate business purpose, it inadvertently creates a security gap when combined with the missing CSRF protections on state-changing endpoints.

Root Cause

The root cause is the absence of CSRF validation in the commentDelete.json.php endpoint. Specifically, the endpoint does not:

1. Call the forbidIfIsUntrustedRequest() function that exists in the codebase
2. Verify any CSRF token or global authentication token
3. Validate the Origin or Referer HTTP headers

Combined with the permissive SameSite=None cookie configuration, this allows any external website to trigger comment deletions using the victim's authenticated session.

Attack Vector

The attack requires user interaction where an authenticated victim must visit an attacker-controlled webpage. The attacker can embed hidden forms or JavaScript that automatically submits POST requests to the vulnerable endpoint. Since the victim's session cookie is automatically included due to the SameSite=None configuration, the AVideo server processes these requests as legitimate authenticated actions.

The following patch demonstrates how the fix addresses this vulnerability by adding the forbidIfIsUntrustedRequest() validation:

 $obj->msg = "";
 
 $plugin = AVideoPlugin::loadPluginIfEnabled('{pluginName}');

 if(!User::isAdmin()){
     $obj->msg = "You cant do this";
     die(json_encode($obj));
 }

+forbidIfIsUntrustedRequest('{pluginName}::{classname}::add');

 $o = new {classname}(@$_POST['id']);
 {columnsAdd}

Source: GitHub Commit Change

The deletion endpoint receives the same protection:

     die(json_encode($obj));
 }

+forbidIfIsUntrustedRequest('{pluginName}::{classname}::delete');

 $id = intval($_POST['id']);
 $row = new {classname}($id);
 $obj->error = !$row->delete();
 die(json_encode($obj));
?>

Source: GitHub Commit Change

Detection Methods for CVE-2026-40929

Indicators of Compromise

• Unexpected bulk deletion of comments across multiple videos
• Web server logs showing POST requests to objects/commentDelete.json.php with external Referer headers
• Multiple comment deletion requests occurring in rapid succession from the same user session
• User reports of comments disappearing without user action

Detection Strategies

• Implement web application firewall (WAF) rules to flag requests to commentDelete.json.php with external or missing Referer headers
• Monitor application logs for comment deletion patterns that indicate automated or bulk operations
• Configure intrusion detection systems to alert on cross-origin requests targeting state-changing endpoints
• Review HTTP request logs for unusual patterns of authenticated requests originating from external domains

Monitoring Recommendations

• Enable detailed logging for all comment-related API endpoints
• Set up alerts for anomalous comment deletion rates per user session
• Monitor for cross-origin requests to sensitive JSON endpoints
• Implement session activity monitoring to detect automated request patterns

How to Mitigate CVE-2026-40929

Immediate Actions Required

• Upgrade WWBN AVideo to a version that includes commit 184f36b1896f3364f864f17c1acca3dd8df3af27 or later
• Review and audit all JSON endpoints for similar missing CSRF protections
• Consider temporarily restricting access to administrative and moderation features until patching is complete
• Alert privileged users (moderators, video owners) about potential phishing attempts

Patch Information

The vulnerability has been fixed in commit 184f36b1896f3364f864f17c1acca3dd8df3af27. The fix implements the forbidIfIsUntrustedRequest() function call on affected endpoints to validate that requests originate from trusted sources. Organizations running WWBN AVideo version 29.0 or earlier should apply this patch immediately.

For detailed patch information, refer to the GitHub Commit Change and the GitHub Security Advisory.

Workarounds

• Implement a reverse proxy rule to block requests to commentDelete.json.php from external Referer origins
• Temporarily disable comment functionality if immediate patching is not possible
• Configure web application firewall rules to require valid Origin headers matching the AVideo domain
• Educate privileged users to avoid clicking links from untrusted sources while logged into AVideo

# Example nginx configuration to block external referers
# Add to your server block configuration
location /objects/commentDelete.json.php {
    # Only allow requests with matching referer
    if ($http_referer !~* "^https?://your-avideo-domain\.com") {
        return 403;
    }
    # Continue with normal processing
    try_files $uri =404;
    fastcgi_pass php-fpm;
}