CVE-2026-114048

Deferred Deferred - Pending Action

CSRF in AVideo Legacy Endpoints

Publication date: 2026-10-21

Last updated on: 2026-10-27

Assigner: VulnCheck

Description

WWBN AVideo before 24.0 contains a cross-site request forgery vulnerability in legacy endpoints like playlistStatus.php that bypass the .json.php-only autoCSRFGuard() check. Attackers can lure logged-in users to a page with an auto-submitting form to make private playlists public, remove playlist videos, or forge video suggestions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-27

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-114048

EUVD

EUVD-2026-106999

Affected Vendors & Products

Vendor	Product	Version / Range
WWBN	AVideo	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

CVE-2026-114048 is a Cross-Site Request Forgery (CSRF) vulnerability in WWBN AVideo versions before 24.0. It affects legacy endpoints like playlistStatus.php where autoCSRFGuard() protection is bypassed. Attackers can trick logged-in users into visiting a malicious page with an auto-submitting form to perform unauthorized actions such as making private playlists public, removing videos from playlists, or forging video suggestions.

Detection Guidance

To detect this vulnerability, inspect your AVideo installation for legacy endpoints like playlistStatus.php, videoSuggest.php, playlistRemoveVideo.php, and videoPinOnChannel.php. Check if these files lack CSRF protections such as autoCSRFGuard() or token-based checks. Review server logs for unusual POST requests to these endpoints from authenticated users.

Impact Analysis

This vulnerability allows attackers to perform unauthorized actions on your behalf if you are logged into AVideo. Potential impacts include your private playlists being made public, videos being removed from your playlists, or video suggestions being forged without your consent.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized modifications to user data or playlists. For example, attackers could make private playlists public or remove videos, which may involve processing or exposing personal data without consent. Such unauthorized changes could violate data integrity and user control principles under GDPR and HIPAA.

Mitigation Strategies

Immediately update AVideo to version 24.0 or later. If updating is not possible, manually add CSRF protections to affected endpoints by implementing checks like forbidIfIsUntrustedRequest() or forbidIfInvalidToken(). Disable legacy endpoints if they are not required. Monitor for unauthorized changes to playlists or video suggestions.

Hi! I’m here to help you understand CVE-2026-114048. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...