CVE-2026-86718: WWBN AVideo CSRF Vulnerability

CVE-2026-86718 Overview

CVE-2026-86718 is a cross-site request forgery (CSRF) vulnerability affecting WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1. The flaw resides in the deleteHistory.json.php and finishAll.json.php endpoints, which accept state-changing GET requests without validating CSRF tokens. Unauthenticated attackers can craft malicious web pages that, when visited by an authenticated administrator, trigger deletion of all live transmission history or mark active streams as finished. The vulnerability maps to CWE-352: Cross-Site Request Forgery.

Critical Impact
An attacker who lures an authenticated AVideo administrator to a crafted page can silently destroy live transmission history and terminate active streams, resulting in loss of operational data integrity.

Affected Products

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1
deleteHistory.json.php endpoint
finishAll.json.php endpoint

Discovery Timeline

2026-09-08 - CVE-2026-86718 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86718

Vulnerability Analysis

WWBN AVideo is an open-source video streaming and hosting platform. The affected endpoints deleteHistory.json.php and finishAll.json.php perform destructive administrative actions, yet they accept HTTP GET requests without validating anti-CSRF tokens or verifying the request origin. This design permits third-party pages to issue cross-origin requests that ride an administrator's active session cookie.

Because the endpoints act on server-side state, a single crafted URL is sufficient to trigger the mutation. The vulnerability requires user interaction from a privileged victim, but no authentication credentials on the attacker's side. The result is unauthorized deletion of live transmission history and forced termination of active streams.

Root Cause

The root cause is the absence of CSRF protection on state-changing endpoints. The scripts trust the presence of a valid session cookie as sufficient authorization, without confirming that the request originated from the AVideo application itself. Accepting GET verbs for destructive operations further amplifies the exposure, since GET requests can be embedded in image tags, iframes, and link prefetches.

Attack Vector

An attacker hosts a page containing an embedded resource that issues a GET request to the vulnerable endpoints on a target AVideo instance. When an authenticated administrator visits the attacker-controlled page from the same browser session, the browser automatically attaches the session cookie. The request executes with administrator privileges, deleting live history or marking streams as finished. Delivery vectors include phishing emails, malicious advertisements, forum posts, and compromised third-party sites.

Refer to the GitHub Security Advisory and the VulnCheck Cross-Site Request Forgery Advisory for the full technical write-up.

Detection Methods for CVE-2026-86718

Indicators of Compromise

Unexpected GET requests to deleteHistory.json.php or finishAll.json.php with Referer or Origin headers pointing to external domains.
Sudden clearing of live transmission history without a corresponding administrator action in application audit logs.
Active live streams transitioning to a finished state outside of scheduled workflows.

Detection Strategies

Inspect web server access logs for the vulnerable endpoint paths and correlate with the source Referer header and session identifier.
Deploy web application firewall rules that flag state-changing GET requests missing a CSRF token parameter.
Baseline administrator activity and alert on bulk history deletion events that fall outside expected maintenance windows.

Monitoring Recommendations

Enable verbose HTTP logging on the AVideo web tier to capture full request URIs, referrers, and user-agent strings.
Forward AVideo application and web server logs to a centralized log platform for cross-source correlation and long-term retention.
Alert on any administrator session performing destructive API calls immediately after loading an external page.

How to Mitigate CVE-2026-86718

Immediate Actions Required

Update WWBN AVideo to a commit later than c3edcc274c389816d434acadac07ee78eaf330c1 once an official patch is available from the maintainers.
Restrict administrative access to the AVideo backend by IP allow-listing or VPN until a fix is deployed.
Instruct administrators to use a dedicated browser or profile for AVideo administration to reduce cross-site exposure.

Patch Information

Monitor the WWBN AVideo GitHub Security Advisory GHSA-gmx5-mhqr-h7rj for patched commit references. Apply the fix by pulling the updated repository state and redeploying the application. Verify that deleteHistory.json.php and finishAll.json.php reject requests lacking a valid CSRF token after the update.

Workarounds

Configure the web server to reject GET requests to deleteHistory.json.php and finishAll.json.php, permitting only authenticated POST requests with a validated token.
Set the AVideo session cookie attributes to SameSite=Strict to prevent the browser from attaching the cookie to cross-site requests.
Deploy a reverse proxy or WAF rule that blocks requests to the vulnerable endpoints when the Origin or Referer header does not match the AVideo host.

bash

# Example nginx configuration to block cross-origin GET requests
location ~ ^/(deleteHistory|finishAll)\.json\.php$ {
    if ($request_method = GET) {
        return 405;
    }
    if ($http_origin !~* ^https://avideo\.example\.com$) {
        return 403;
    }
    include fastcgi_params;
    fastcgi_pass php-fpm;
}