Compliance Impact

The vulnerability allows an attacker to silently disable two-factor authentication (2FA) on a victim's account without their consent, which significantly weakens account security.

Disabling 2FA can lead to unauthorized access and potential full account compromise, increasing the risk of data breaches.

Such unauthorized access and potential data breaches could result in non-compliance with security requirements mandated by common standards and regulations like GDPR and HIPAA, which require appropriate safeguards to protect personal and sensitive data.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-45610 is a Cross-Site Request Forgery (CSRF) vulnerability in the WWBN AVideo platform's LoginControl plugin. Specifically, the vulnerability exists in the endpoint that toggles two-factor authentication (2FA) for users. This endpoint does not have proper CSRF protections, such as token validation or re-authentication steps.

An attacker can exploit this by tricking a logged-in user into visiting a malicious webpage that silently sends a POST request to disable the victim's 2FA without their knowledge or consent.

The attack requires the victim to be logged into the AVideo dashboard, and it works because the session cookie is sent with the request due to the SameSite attribute being set to Lax. The vulnerability arises from missing CSRF checks and lack of additional authentication when disabling 2FA.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have a significant impact by allowing an attacker to silently disable two-factor authentication (2FA) on a victim's account.

Disabling 2FA reduces the security of the account, making it easier for attackers to gain full access, especially if combined with other attacks like credential stuffing or phishing.

Once 2FA is disabled, the attacker can potentially compromise the victim's account integrity without the victim's knowledge, leading to unauthorized access and possible misuse of the account.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for unauthorized POST requests to the endpoint plugin/LoginControl/set.json.php with the parameter type=set2FA and value=false. Such requests indicate attempts to disable 2FA without proper authorization.

Network detection can involve capturing HTTP traffic and filtering for POST requests targeting the set2FA toggle endpoint.

• Use tools like tcpdump or Wireshark to capture HTTP POST requests to plugin/LoginControl/set.json.php.
• Example tcpdump command: tcpdump -i any -A 'tcp port 80 or tcp port 443' | grep 'POST /plugin/LoginControl/set.json.php'
• Use web server logs to search for POST requests with parameters type=set2FA and value=false.
• Example grep command on access logs: grep 'POST /plugin/LoginControl/set.json.php' /var/log/apache2/access.log | grep 'type=set2FA' | grep 'value=false'

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include implementing CSRF protection on the vulnerable endpoint to prevent unauthorized POST requests.

Specifically, add checks such as forbidIfIsUntrustedRequest(), validate CSRF tokens, and enforce SameSite cookie attributes properly.

Additionally, require step-up authentication (e.g., re-entering password or current 2FA code) before allowing 2FA to be disabled.

Until a patch is applied, consider restricting access to the affected endpoint or monitoring and blocking suspicious POST requests.

Useful 0 Not Useful 0