CVE-2026-34613
published 2026-03-31CVE-2026-34613: WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo endpoint objects/pluginSwitch.json.php allows administrators to enable or…
PriorityP335medium6.5CVSS 3.1
AVNACLPRNUIRSUCNIHAN
EPSS
0.20%
10.2th percentile
WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo endpoint objects/pluginSwitch.json.php allows administrators to enable or disable any installed plugin. The endpoint checks for an active admin session but does not validate a CSRF token. Additionally, the plugins database table is explicitly listed in ignoreTableSecurityCheck(), which means the ORM-level Referer/Origin domain validation in ObjectYPT::save() is also bypassed. Combined with SameSite=None on session cookies, an attacker can disable critical security plugins (such as LoginControl for 2FA, subscription enforcement, or access control plugins) by luring an admin to a malicious page. At time of publication, there are no publicly available patches.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| wwbn | avideo | <= 26.0 | — |
| wwbn | avideo | 0 – 26.0 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
AVideo: CSRF on Plugin Enable/Disable Endpoint Allows Disabling Security Plugins
osv·2026-04-01
CVE-2026-34613 [MEDIUM] AVideo: CSRF on Plugin Enable/Disable Endpoint Allows Disabling Security Plugins
AVideo: CSRF on Plugin Enable/Disable Endpoint Allows Disabling Security Plugins
## Summary
The AVideo endpoint `objects/pluginSwitch.json.php` allows administrators to enable or disable any installed plugin. The endpoint checks for an active admin session but does not validate a CSRF token. Additionally, the `plugins` database table is explicitly listed in `ignoreTableSecurityCheck()`, which means the ORM-level Referer/Origin domain validation in `ObjectYPT::save()` is also bypassed. Combined with `SameSite=None` on session cookies, an attacker can disable critical security plugins (such as LoginControl for 2FA, subscription enforcement, or access control plugins) by luring an admin to a malicious page.
Plugin UUIDs are not secret values. They are hardcoded in the frontend JavaScript s
GHSA
AVideo: CSRF on Plugin Enable/Disable Endpoint Allows Disabling Security Plugins
ghsa·2026-04-01
CVE-2026-34613 [MEDIUM] CWE-352 AVideo: CSRF on Plugin Enable/Disable Endpoint Allows Disabling Security Plugins
AVideo: CSRF on Plugin Enable/Disable Endpoint Allows Disabling Security Plugins
## Summary
The AVideo endpoint `objects/pluginSwitch.json.php` allows administrators to enable or disable any installed plugin. The endpoint checks for an active admin session but does not validate a CSRF token. Additionally, the `plugins` database table is explicitly listed in `ignoreTableSecurityCheck()`, which means the ORM-level Referer/Origin domain validation in `ObjectYPT::save()` is also bypassed. Combined with `SameSite=None` on session cookies, an attacker can disable critical security plugins (such as LoginControl for 2FA, subscription enforcement, or access control plugins) by luring an admin to a malicious page.
Plugin UUIDs are not secret values. They are hardcoded in the frontend JavaScript s
No detection rules found.
No public exploits indexed.
2026-03-31
Published