CVE-2026-58003: WWBN AVideo CSRF Vulnerability

CVE-2026-58003 Overview

CVE-2026-58003 is a cross-site request forgery (CSRF) vulnerability in WWBN AVideo through commit 9c39d8c8. The releaseVideoNow.json.php endpoint accepts GET requests and lacks authenticity token validation. Attackers can craft a malicious cross-site GET request that leverages an authenticated administrator's session cookie to permanently publish any embargoed video by manipulating the videos_id parameter. The flaw is categorized under CWE-352: Cross-Site Request Forgery.

Critical Impact
An attacker who tricks an authenticated administrator into visiting a crafted page can permanently release embargoed videos without consent, breaking content confidentiality and editorial control.

Affected Products

WWBN AVideo through commit 9c39d8c8
releaseVideoNow.json.php endpoint
Deployments running any prior revisions that share the vulnerable endpoint handler

Discovery Timeline

2026-08-22 - CVE-2026-58003 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-58003

Vulnerability Analysis

The vulnerability resides in the releaseVideoNow.json.php endpoint of WWBN AVideo, an open-source video streaming platform. The endpoint performs a state-changing action, releasing an embargoed video for public consumption, but it does not verify request authenticity. It accepts requests via HTTP GET and processes the videos_id parameter directly against the caller's session context. Because browsers automatically attach session cookies to cross-origin GET requests, an attacker can force an authenticated administrator to trigger the release action by loading a crafted URL, image tag, or hidden iframe.

Root Cause

The root cause is missing CSRF protection on a privileged state-changing endpoint. There is no anti-CSRF token, no Origin or Referer validation, and no requirement that the action use HTTP POST with a same-site guard. Sensitive operations are exposed through a safe HTTP method (GET), which violates the HTTP specification's guidance that GET requests should not have side effects.

Attack Vector

Exploitation requires an authenticated administrator to load attacker-controlled content while their AVideo session is active. The adversary hosts a page containing a resource reference such as an <img> tag pointing at releaseVideoNow.json.php?videos_id=<target>. The victim's browser issues the GET request with the administrator's session cookie attached. The server executes the release, and the previously embargoed video becomes publicly visible. No user interaction beyond visiting the malicious page is required, though phishing or social engineering typically delivers the payload.

No verified public proof-of-concept code is available. Additional technical detail is documented in the GitHub Security Advisory GHSA-q8cg-7x7q-c4g2 and the VulnCheck Advisory for AVideo CSRF.

Detection Methods for CVE-2026-58003

Indicators of Compromise

Web server access logs showing GET requests to /releaseVideoNow.json.php with a videos_id query parameter originating from an external Referer header.
Unexpected transitions of videos from embargoed to published status without a corresponding administrator action in the audit trail.
Administrator sessions issuing sensitive endpoint requests within seconds of loading unrelated external URLs.

Detection Strategies

Alert on any request to releaseVideoNow.json.php where the Referer or Origin header does not match the AVideo host.
Correlate video state changes with the authenticated user's recent navigation history to flag activity inconsistent with normal editorial workflows.
Deploy web application firewall (WAF) rules that inspect for GET-based invocations of state-changing AVideo endpoints.

Monitoring Recommendations

Ingest AVideo web server and application logs into a centralized analytics platform and retain them for retrospective hunting.
Monitor administrator account activity for anomalous cross-origin request patterns and off-hours video releases.
Track outbound clicks and email links delivered to administrators, as CSRF exploitation typically pairs with phishing.

How to Mitigate CVE-2026-58003

Immediate Actions Required

Restrict administrative access to the AVideo instance behind a VPN or IP allowlist until a patched build is deployed.
Instruct administrators to log out of AVideo when not actively managing content and to avoid browsing untrusted sites in the same browser profile.
Review the video catalog for unauthorized state changes and re-embargo any content that was released without approval.

Patch Information

No fixed commit is identified in the current NVD entry. Monitor the WWBN AVideo GitHub Security Advisory for the remediating commit and upgrade guidance. Apply the fix as soon as it is published upstream.

Workarounds

Add a reverse-proxy or WAF rule that blocks GET requests to releaseVideoNow.json.php and requires POST with a valid anti-CSRF token.
Enforce SameSite=Strict on AVideo session cookies to prevent them from being sent on cross-site requests.
Validate Origin and Referer headers at the proxy layer and reject requests to sensitive endpoints when they do not match the AVideo hostname.

bash

# Example NGINX rule to block GET-based invocations of the vulnerable endpoint
location = /releaseVideoNow.json.php {
    if ($request_method = GET) { return 403; }
    if ($http_origin !~* "^https://avideo\.example\.com$") { return 403; }
    proxy_pass http://avideo_backend;
}