CVE-2026-86719: WWBN AVideo CSRF Vulnerability

CVE-2026-86719 Overview

CVE-2026-86719 is a cross-site request forgery (CSRF) vulnerability [CWE-352] in WWBN AVideo, affecting the CustomizeUser plugin endpoint plugin/CustomizeUser/swapUser.json.php. The endpoint reads users_id from $_REQUEST and invokes User::swapUser() without enforcing POST-only access or validating a CSRF token. An attacker who tricks an authenticated administrator into loading a crafted URL can swap the administrator's session to a non-admin account. The response also discloses the session_id. The CustomizeUser plugin is enabled by default, and no patch was available at publication.

Critical Impact
An authenticated administrator viewing an attacker-controlled page can be silently swapped into a non-admin session, losing administrative access and exposing their session identifier.

Affected Products

WWBN AVideo (master branch)
Commits through c3edcc274c389816d434acadac07ee78eaf330c1
Installations with the default-enabled CustomizeUser plugin

Discovery Timeline

2026-09-08 - CVE-2026-86719 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-86719

Vulnerability Analysis

The CustomizeUser plugin exposes the swapUser.json.php endpoint, which is intended to let administrators temporarily assume another user's session for support purposes. The endpoint reads the target users_id parameter from PHP's $_REQUEST superglobal, which accepts values from GET, POST, and cookie sources. It then calls User::swapUser() immediately, without invoking forbidIfNotPost() or forbidIfInvalidToken(). AVideo's global autoCSRFGuard() protection only runs for POST requests to *.json.php endpoints, so a GET request bypasses CSRF validation entirely. Swapping into another administrator account is rejected, so the flaw is limited to session downgrade rather than privilege escalation. The JSON response additionally returns the new session identifier, giving an attacker with response visibility a valid session_id.

Root Cause

The root cause is missing CSRF protection combined with acceptance of state-changing actions over GET. The endpoint relies on the global guard, which does not cover GET traffic, and does not enforce its own request-method or token checks.

Attack Vector

Exploitation requires an authenticated administrator to load attacker-controlled content in the same browser session. A cross-origin <img> tag, hyperlink, or auto-loaded resource pointing at plugin/CustomizeUser/swapUser.json.php?users_id=<id> triggers the swap. See the GitHub Security Advisory and the VulnCheck Advisory for AVideo for full technical details.

Detection Methods for CVE-2026-86719

Indicators of Compromise

GET requests to plugin/CustomizeUser/swapUser.json.php containing a users_id query parameter.
Web server access logs showing cross-origin Referer headers preceding a session role change.
Unexpected transitions of an administrator session to a non-admin users_id without a corresponding UI-initiated POST.
Application logs recording User::swapUser() invocations outside normal administrative workflows.

Detection Strategies

Alert on any HTTP GET request to swapUser.json.php, since legitimate use of this endpoint should be POST-only.
Correlate Referer header values against the AVideo application origin to identify cross-site triggers.
Monitor session state changes where an administrator's session users_id is replaced within a short window of an inbound GET request.

Monitoring Recommendations

Ingest AVideo web server logs into a centralized logging platform and retain full request URIs and referrer data.
Track JSON responses from swapUser.json.php that expose a session_id field, and alert on unusual volumes.
Review administrator activity for unexplained loss of privileges followed by session cancellations.

How to Mitigate CVE-2026-86719

Immediate Actions Required

Disable the CustomizeUser plugin in AVideo until a fix is available, since it is enabled by default.
Restrict access to plugin/CustomizeUser/swapUser.json.php at the web server or reverse proxy layer to block GET requests.
Advise administrators to use a dedicated browser profile that does not visit untrusted sites while authenticated to AVideo.

Patch Information

No vendor patch was available at the time of CVE publication. Track the GitHub Security Advisory for updates and apply upstream fixes once released.

Workarounds

Enforce a web application firewall (WAF) rule that rejects GET requests to */plugin/CustomizeUser/swapUser.json.php.
Require SameSite=Strict on the AVideo session cookie to prevent cross-site request inclusion.
Terminate active administrator sessions and rotate session identifiers if suspicious swap activity is detected.

bash

# Example NGINX rule to block GET requests to the vulnerable endpoint
location ~* /plugin/CustomizeUser/swapUser\.json\.php$ {
    limit_except POST {
        deny all;
    }
}