CVE-2026-35181
published 2026-04-06CVE-2026-35181: WWBN AVideo is an open source video platform. In versions 26.0 and prior, the player skin configuration endpoint at admin/playerUpdate.json.php does not…
PriorityP421medium4.3CVSS 3.1
AVNACLPRNUIRSUCNILAN
EPSS
0.13%
3.3th percentile
WWBN AVideo is an open source video platform. In versions 26.0 and prior, the player skin configuration endpoint at admin/playerUpdate.json.php does not validate CSRF tokens. The plugins table is explicitly excluded from the ORM's domain-based security check via ignoreTableSecurityCheck(), removing the only other layer of defense. Combined with SameSite=None cookies, a cross-origin POST can modify the video player appearance on the entire platform.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| wwbn | avideo | <= 26.0 | — |
| wwbn | avideo | 0 – 26.0 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
AVideo: CSRF on Player Skin Configuration via admin/playerUpdate.json.php
ghsa·2026-04-03
CVE-2026-35181 [MEDIUM] CWE-352 AVideo: CSRF on Player Skin Configuration via admin/playerUpdate.json.php
AVideo: CSRF on Player Skin Configuration via admin/playerUpdate.json.php
**Severity:** Medium
**CWE:** CWE-352 (Cross-Site Request Forgery)
## Summary
The player skin configuration endpoint at `admin/playerUpdate.json.php` does not validate CSRF tokens. The `plugins` table is explicitly excluded from the ORM's domain-based security check via `ignoreTableSecurityCheck()`, removing the only other layer of defense. Combined with `SameSite=None` cookies, a cross-origin POST can modify the video player appearance on the entire platform.
## Details
In `admin/playerUpdate.json.php` at line 17, the player skin is set directly from POST data:
```php
$pluginDO->skin = $_POST['skin'];
```
No CSRF token is validated anywhere in the endpoint. Normally, the ORM layer performs a Referer/Origin do
OSV
AVideo: CSRF on Player Skin Configuration via admin/playerUpdate.json.php
osv·2026-04-03
CVE-2026-35181 [MEDIUM] AVideo: CSRF on Player Skin Configuration via admin/playerUpdate.json.php
AVideo: CSRF on Player Skin Configuration via admin/playerUpdate.json.php
**Severity:** Medium
**CWE:** CWE-352 (Cross-Site Request Forgery)
## Summary
The player skin configuration endpoint at `admin/playerUpdate.json.php` does not validate CSRF tokens. The `plugins` table is explicitly excluded from the ORM's domain-based security check via `ignoreTableSecurityCheck()`, removing the only other layer of defense. Combined with `SameSite=None` cookies, a cross-origin POST can modify the video player appearance on the entire platform.
## Details
In `admin/playerUpdate.json.php` at line 17, the player skin is set directly from POST data:
```php
$pluginDO->skin = $_POST['skin'];
```
No CSRF token is validated anywhere in the endpoint. Normally, the ORM layer performs a Referer/Origin do
No detection rules found.
No public exploits indexed.
2026-04-06
Published