CVE-2026-57944
Received Received - Intake

Cross-Site Request Forgery in AVideo

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: VulnCheck

Description
AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in channelToGallery.json.php that allows attackers to modify site-wide Gallery configuration by performing unauthorized writes to plugin data. Attackers can craft a cross-site GET request carrying an administrator's session cookie to promote arbitrary channels to the front page or delete curated sections without token validation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-57944
EUVD
EUVD-2026-64260

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wwbn avideo to 9c39d8c8 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Cross-Site Request Forgery (CSRF) vulnerability in AVideo where attackers can modify site-wide Gallery configuration without proper validation. The flaw exists in channelToGallery.json.php, allowing unauthorized writes to plugin data by crafting malicious GET requests that include an administrator's session cookie. Attackers can promote arbitrary channels to the front page or delete curated sections.

Detection Guidance

To detect this CSRF vulnerability in AVideo, inspect the channelToGallery.json.php file in the plugin/Gallery directory for missing CSRF token validation. Check if the endpoint accepts GET requests and lacks proper session authenticity checks. Review server logs for unusual GET requests to this file with parameters like users_id or add.

Impact Analysis

If you are an administrator of an AVideo site, an attacker could trick you into loading a malicious page or image, which would execute unauthorized actions on your behalf. This could lead to your site's front-page configuration being altered, such as promoting unwanted channels or deleting sections, disrupting your site's content and user experience.

Compliance Impact

This CSRF vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized modifications to website content. For GDPR, it may affect data integrity and user control over personal data if gallery configurations are altered without consent. For HIPAA, unauthorized changes to displayed content could compromise the integrity of healthcare-related information presented on the site.

Mitigation Strategies

Immediately update AVideo to a patched version that enforces CSRF token validation and rejects GET requests for channelToGallery.json.php. Disable SameSite=None for session cookies if possible. Audit other plugin endpoints for similar CSRF flaws. Monitor for unauthorized changes to Gallery configuration.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-57944. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart