CVE-2026-81733: WWBN AVideo CSRF Vulnerability

CVE-2026-81733 Overview

CVE-2026-81733 is a cross-site request forgery (CSRF) vulnerability [CWE-352] in WWBN AVideo through version 30.0, including master builds up to commit 4cb576e. The flaw resides in plugin/Live/myLiveControls.save.json.php, which processes the customUrl, customMessage, and autoRedirect parameters from $_REQUEST via GET without validating a CSRF token or request origin. An attacker who lures a logged-in streamer to a malicious page can silently modify the streamer's live-channel viewer-redirect settings, persisted in users.externalOptions. The altered configuration can redirect viewers to a phishing site or display a spoofed message under the streamer's channel.

Critical Impact
Attackers can hijack live-channel viewer redirects to send legitimate audiences to phishing pages without touching the streamer's credentials.

Affected Products

WWBN AVideo through version 30.0
WWBN AVideo master branch up to commit 4cb576e
plugin/Live/myLiveControls.save.json.php endpoint

Discovery Timeline

2026-08-28 - CVE-2026-81733 published to NVD
2026-08-29 - Last updated in NVD database

Technical Details for CVE-2026-81733

Vulnerability Analysis

The vulnerable endpoint plugin/Live/myLiveControls.save.json.php accepts state-changing input through GET requests. It reads the customUrl, customMessage, and autoRedirect values from PHP's $_REQUEST superglobal, meaning both query-string and body parameters are honored. The only authorization check is a session-based test that the caller is logged in. No anti-CSRF token, no SameSite-hardened cookie flow, and no Origin or Referer verification is enforced.

Because the parameters are persisted to users.externalOptions, a successful forgery leaves durable configuration changes on the victim's channel. Viewers hitting the channel afterward are transparently redirected or shown attacker-controlled content, extending the impact from the streamer to the broader viewer base.

Root Cause

The root cause is missing CSRF protection on an authenticated, state-changing endpoint combined with acceptance of GET requests for a write operation. Using $_REQUEST further broadens the attack surface by allowing the payload to be delivered as query parameters embedded in <img>, <script>, or auto-submitting form tags.

Attack Vector

Exploitation requires an authenticated streamer to visit an attacker-controlled page while their AVideo session is active. The malicious page issues a cross-origin GET request to plugin/Live/myLiveControls.save.json.php with attacker-chosen values for customUrl, customMessage, and autoRedirect. The browser attaches the session cookie, the server accepts the request, and the settings are written to the streamer's profile. No user interaction beyond visiting the malicious page is required.

See the GitHub Security Advisory GHSA-wpr3-456q-6vgc and the VulnCheck advisory on AVideo CSRF for additional technical context.

Detection Methods for CVE-2026-81733

Indicators of Compromise

Unexpected values in the externalOptions field of the users table, particularly modifications to customUrl, customMessage, or autoRedirect.
Web server access logs showing GET requests to plugin/Live/myLiveControls.save.json.php originating from external Referer headers.
Viewer reports of unexpected redirects away from a live channel to unfamiliar domains.

Detection Strategies

Alert on any request to myLiveControls.save.json.php where the HTTP Referer or Origin header does not match the AVideo application host.
Baseline the frequency of live-control changes per streamer and flag off-hours or high-frequency modifications.
Correlate configuration writes to users.externalOptions with the source IP and User-Agent of the initiating session.

Monitoring Recommendations

Enable audit logging for all writes to the users table columns storing live-channel redirect settings.
Forward web access logs and application audit events to a centralized analytics platform for cross-session correlation.
Monitor outbound viewer traffic for redirects to newly registered or low-reputation domains.

How to Mitigate CVE-2026-81733

Immediate Actions Required

Restrict access to plugin/Live/myLiveControls.save.json.php at the web server or reverse proxy layer until a patched build is deployed.
Audit the users.externalOptions field for unauthorized customUrl, customMessage, or autoRedirect values and revert unexpected changes.
Force re-authentication of active streamer sessions and rotate session identifiers.

Patch Information

No fixed version was published in the NVD entry at time of writing. Monitor the GitHub Security Advisory GHSA-wpr3-456q-6vgc for an official patched release and apply it as soon as it is available. Users on the master branch should track commits beyond 4cb576e for the CSRF fix.

Workarounds

Configure a web application firewall rule that blocks GET requests to myLiveControls.save.json.php and requires POST with a validated CSRF token.
Set session cookies to SameSite=Lax or SameSite=Strict to reduce cross-origin cookie attachment on state-changing requests.
Add server-side Origin and Referer header validation for all authenticated write endpoints in the plugin/Live/ directory.

bash

# Example nginx rule to block cross-origin GET writes to the vulnerable endpoint
location = /plugin/Live/myLiveControls.save.json.php {
    if ($request_method = GET) { return 403; }
    if ($http_origin !~* ^https://avideo\.example\.com$) { return 403; }
    proxy_pass http://avideo_backend;
}