CVE-2026-43880: WWBN AVideo Auth Bypass Vulnerability

CVE-2026-43880 Overview

CVE-2026-43880 affects WWBN AVideo, an open source video platform, in all versions up to and including 29.0. The vulnerability resides in objects/sendEmail.json.php, which is allow-listed as a public write action in objects/functionsSecurity.php at line 885. When the contactForm parameter is omitted, the endpoint accepts an attacker-supplied recipient and uses the site's own contact email as the From: and Reply-To: headers. An unauthenticated attacker who solves the captcha can abuse the site's Simple Mail Transfer Protocol (SMTP) infrastructure to deliver attacker-composed emails from the site's legitimate sender address. The vulnerability is tracked under [CWE-940: Improper Verification of Source of a Communication Channel].

Critical Impact

Unauthenticated attackers can send emails from the site's legitimate address that pass SPF, DKIM, and DMARC validation, enabling targeted phishing and brand impersonation.

Affected Products

• WWBN AVideo versions up to and including 29.0
• objects/sendEmail.json.php endpoint
• Deployments using the site's configured contact email and SMTP infrastructure

Discovery Timeline

• 2026-05-11 - CVE-2026-43880 published to NVD
• 2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-43880

Vulnerability Analysis

The flaw is a missing authentication check on a mail-sending endpoint. objects/sendEmail.json.php exposes two execution paths controlled by the contactForm POST parameter. When contactForm=1 is submitted, the endpoint behaves as a standard contact form. When the parameter is omitted, the endpoint treats the request as a share or arbitrary-recipient path and sets $sendTo to an attacker-controlled email address.

For unauthenticated callers, User::getEmail_() returns an empty string. The code then falls back to $config->getContactEmail() for the reply address, and $mail->setFrom($replyTo) sets the outgoing From: header to the site's own contact address. The endpoint is explicitly allow-listed as a public write action in objects/functionsSecurity.php at line 885, bypassing both authentication and Cross-Site Request Forgery (CSRF) token checks.

Root Cause

The root cause is improper verification of the source of a communication channel. The mail-sending logic does not require authentication for the arbitrary-recipient code path, and it derives the sender identity from server-side configuration rather than from the authenticated caller. Combined with the public allow-list entry, this lets any captcha-solving client direct outbound mail from the site's trusted domain.

Attack Vector

An attacker submits a POST request to objects/sendEmail.json.php without contactForm=1, supplies an arbitrary recipient address and message body, and solves the captcha. The resulting email leaves the site's SMTP infrastructure with the site's contact address in the From: and Reply-To: headers. SPF, DKIM, and DMARC checks pass because the message originates from the legitimate domain, making the email indistinguishable from genuine site communications.

 if(User::isAdmin()){
     $valid = true;
 }
+
+// Reject the arbitrary-recipient (share) path for unauthenticated callers.
+// Without this guard an unauthenticated attacker can force the site's own
+// SMTP infrastructure to send attacker-composed mail to any recipient:
+// User::getEmail_() returns '' when not logged in, so $replyTo falls back
+// to $config->getContactEmail(), and $mail->setFrom($replyTo) makes the
+// message appear to originate From the site's own legitimate address --
+// passing SPF/DKIM/DMARC and enabling targeted phishing / brand impersonation.
+if (empty($_POST['contactForm']) && !User::isLogged()) {
+    $obj = new stdClass();
+    $obj->error = __('Authentication required');
+    header('Content-Type: application/json');
+    echo json_encode($obj);
+    exit;
+}
+
 $obj = new stdClass();
 $obj->error = '';
 if ($valid) {

Source: GitHub Commit 4e3709895857a5857f0edb46b0ee984de0d9e1a2

Detection Methods for CVE-2026-43880

Indicators of Compromise

• POST requests to objects/sendEmail.json.php without a contactForm=1 parameter from unauthenticated sessions.
• Outbound SMTP messages originating from the AVideo host with From: set to the configured contact email but addressed to recipients outside the user base.
• Spikes in outbound mail volume from the AVideo SMTP relay correlated with anonymous web traffic.
• User reports of phishing emails passing SPF, DKIM, and DMARC for the site's domain.

Detection Strategies

• Inspect web server access logs for requests to objects/sendEmail.json.php and flag any lacking the contactForm parameter.
• Correlate captcha-solve events with subsequent SMTP send operations to identify abuse patterns.
• Apply mail gateway rules that compare outbound recipient addresses against the registered user directory.

Monitoring Recommendations

• Enable verbose SMTP logging on the AVideo host and forward logs to a centralized analytics platform.
• Alert on outbound message rates exceeding baseline thresholds for the site's contact email identity.
• Monitor reverse DNS and domain reputation services for new reports of phishing originating from the site's domain.

How to Mitigate CVE-2026-43880

Immediate Actions Required

• Apply the upstream fix from commit 4e3709895857a5857f0edb46b0ee984de0d9e1a2 to all AVideo deployments running version 29.0 or earlier.
• Audit recent outbound mail logs for messages sent through objects/sendEmail.json.php and notify affected recipients of potential phishing.
• Rotate any credentials, tokens, or links that may have been disclosed in attacker-composed emails sent from the site.

Patch Information

The maintainers published an updated fix in commit 4e3709895857a5857f0edb46b0ee984de0d9e1a2. The patch rejects the arbitrary-recipient path when contactForm is empty and the caller is not logged in, returning an Authentication required JSON error. Details are documented in GitHub Security Advisory GHSA-5hgj-7gm9-cff5.

Workarounds

• Remove sendEmail.json.php from the public write-action allow-list in objects/functionsSecurity.php until the patch can be applied.
• Block unauthenticated POST requests to objects/sendEmail.json.php at the web application firewall or reverse proxy layer.
• Restrict the SMTP relay so it only accepts mail destined for known user addresses associated with the platform.

# Web server rule to block unauthenticated arbitrary-recipient requests
location = /objects/sendEmail.json.php {
    if ($request_method = POST) {
        set $block 1;
    }
    if ($arg_contactForm = "1") {
        set $block 0;
    }
    if ($cookie_PHPSESSID = "") {
        set $block 1;
    }
    if ($block = 1) {
        return 403;
    }
}