CVE-2026-57944: AVideo CSRF Vulnerability in Gallery Config

CVE-2026-57944 Overview

CVE-2026-57944 is a cross-site request forgery (CSRF) vulnerability [CWE-352] in AVideo through commit 9c39d8c8. The flaw resides in channelToGallery.json.php, which accepts state-changing requests without validating an anti-CSRF token. An attacker who lures an authenticated administrator to a malicious page can issue cross-site GET requests using the administrator's session cookie. Successful exploitation modifies site-wide Gallery configuration, promoting arbitrary channels to the front page or deleting curated sections. The vulnerability requires user interaction from a privileged victim but no attacker authentication.

Critical Impact
Unauthenticated attackers can silently alter AVideo Gallery plugin data by tricking an administrator into visiting an attacker-controlled page.

Affected Products

AVideo (WWBN) through commit 9c39d8c8
Component: channelToGallery.json.php endpoint
Deployments exposing the AVideo administrative interface to internet users

Discovery Timeline

2026-08-22 - CVE-2026-57944 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-57944

Vulnerability Analysis

AVideo is an open-source video platform maintained by WWBN. The channelToGallery.json.php endpoint manages associations between user channels and Gallery plugin sections. The endpoint performs write operations against plugin configuration data whenever it receives a request bearing a valid administrator session cookie.

Browsers automatically attach session cookies to cross-origin requests unless SameSite protections apply. Because the endpoint accepts GET requests and does not enforce a synchronizer token, any HTML embedded in a third-party page can trigger the action. An attacker hosts a page containing an <img> tag, form, or fetch call pointing to the vulnerable URL. When an authenticated administrator loads the page, the browser issues the request under the administrator's identity.

The attacker gains no direct code execution or data exfiltration primitive. The impact is limited to integrity of Gallery configuration and availability of curated content, consistent with the vulnerability's scope.

Root Cause

The endpoint lacks CSRF token validation and does not verify the Origin or Referer header on write operations. It also treats GET as an acceptable method for state-changing actions, violating safe-method conventions defined in RFC 7231.

Attack Vector

Exploitation proceeds through the network with low complexity and requires the victim administrator to load an attacker-controlled page. Because the flaw is exercised through a forged request, no attacker credentials, tokens, or session material are needed. The attacker must know or guess the target AVideo instance URL and the channel or section identifiers to manipulate. See the GitHub Security Advisory GHSA-8qq4-h7xj-p2c4 and the VulnCheck Advisory on AVideo CSRF for endpoint-level detail.

No verified public proof-of-concept code is included in the referenced advisories, so no exploitation code is reproduced here.

Detection Methods for CVE-2026-57944

Indicators of Compromise

Requests to /plugin/Gallery/channelToGallery.json.php originating with a Referer header pointing to an external, untrusted domain.
Unexpected modifications to Gallery plugin configuration, including new channels promoted to the front page or removal of curated sections.
Administrator sessions issuing state-changing GET requests immediately after visiting external URLs in web proxy logs.

Detection Strategies

Alert on HTTP GET requests to channelToGallery.json.php where the Origin or Referer header does not match the AVideo host.
Correlate administrator authentication events with subsequent Gallery configuration writes and flag those preceded by cross-origin navigation.
Baseline the frequency of channel promotion and deletion events, then alert on statistical deviations.

Monitoring Recommendations

Enable verbose access logging on the AVideo web server and forward logs to a central analytics platform for retention and query.
Track changes to the Gallery plugin's persisted configuration store using file integrity monitoring or database audit triggers.
Review administrator activity trails for out-of-hours or geographically anomalous session use.

How to Mitigate CVE-2026-57944

Immediate Actions Required

Restrict access to the AVideo administrative interface using network allow-lists or VPN gating until a patched build is deployed.
Instruct administrators to log out of AVideo before browsing untrusted sites and to use a dedicated browser profile for admin work.
Audit recent Gallery plugin changes and revert unauthorized modifications to channel or section membership.

Patch Information

At the time of publication, the referenced advisories describe the flaw in AVideo through commit 9c39d8c8. Consult the GitHub Security Advisory GHSA-8qq4-h7xj-p2c4 for the current fix status and update to the latest release from the AVideo project once a patched commit is available.

Workarounds

Configure the AVideo session cookie with SameSite=Lax or SameSite=Strict to prevent the browser from attaching it to cross-site requests.
Deploy a web application firewall rule that blocks requests to channelToGallery.json.php whose Origin or Referer header does not match the AVideo host.
Reject HTTP GET methods on channelToGallery.json.php at the reverse proxy layer, requiring authenticated POST with a server-issued token.

bash

# Example nginx snippet enforcing same-origin on the vulnerable endpoint
location = /plugin/Gallery/channelToGallery.json.php {
    if ($request_method = GET) { return 405; }
    if ($http_origin !~* "^https://avideo\.example\.com$") { return 403; }
    proxy_pass http://avideo_backend;
}