CVE-2026-34611
published 2026-03-31CVE-2026-34611: WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo endpoint objects/emailAllUsers.json.php allows administrators to send HTML…
PriorityP434medium6.5CVSS 3.1
AVNACLPRNUIRSUCNIHAN
EPSS
0.16%
5.3th percentile
WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo endpoint objects/emailAllUsers.json.php allows administrators to send HTML emails to every registered user on the platform. While the endpoint verifies admin session status, it does not validate a CSRF token. Because AVideo sets SameSite=None on session cookies, a cross-origin POST request from an attacker-controlled page will include the admin's session cookie automatically. An attacker who lures an admin to a malicious page can send an arbitrary HTML email to every user on the platform, appearing to originate from the instance's legitimate SMTP address. At time of publication, there are no publicly available patches.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| wwbn | avideo | <= 26.0 | — |
| wwbn | avideo | 0 – 26.0 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
AVideo: CSRF on emailAllUsers.json.php Enables Mass Phishing Email to All Users
ghsa·2026-04-01
CVE-2026-34611 [MEDIUM] CWE-352 AVideo: CSRF on emailAllUsers.json.php Enables Mass Phishing Email to All Users
AVideo: CSRF on emailAllUsers.json.php Enables Mass Phishing Email to All Users
## Summary
The AVideo endpoint `objects/emailAllUsers.json.php` allows administrators to send HTML emails to every registered user on the platform. While the endpoint verifies admin session status, it does not validate a CSRF token. Because AVideo sets `SameSite=None` on session cookies, a cross-origin POST request from an attacker-controlled page will include the admin's session cookie automatically. An attacker who lures an admin to a malicious page can send an arbitrary HTML email to every user on the platform, appearing to originate from the instance's legitimate SMTP address.
The endpoint does not call `save()` on any ORM object, which means the Referer/Origin domain validation implemented in `ObjectYPT
OSV
AVideo: CSRF on emailAllUsers.json.php Enables Mass Phishing Email to All Users
osv·2026-04-01
CVE-2026-34611 [MEDIUM] AVideo: CSRF on emailAllUsers.json.php Enables Mass Phishing Email to All Users
AVideo: CSRF on emailAllUsers.json.php Enables Mass Phishing Email to All Users
## Summary
The AVideo endpoint `objects/emailAllUsers.json.php` allows administrators to send HTML emails to every registered user on the platform. While the endpoint verifies admin session status, it does not validate a CSRF token. Because AVideo sets `SameSite=None` on session cookies, a cross-origin POST request from an attacker-controlled page will include the admin's session cookie automatically. An attacker who lures an admin to a malicious page can send an arbitrary HTML email to every user on the platform, appearing to originate from the instance's legitimate SMTP address.
The endpoint does not call `save()` on any ORM object, which means the Referer/Origin domain validation implemented in `ObjectYPT
No detection rules found.
No public exploits indexed.
2026-03-31
Published