Cross-Site Request Forgery in WWBN AVideo Admin Email Handling

Executive Summary

CVE-2026-82647 is a Cross-Site Request Forgery (CSRF) vulnerability in WWBN AVideo's sendEmail.json.php endpoint. It allows authenticated administrators to send emails from the site's contact address to any recipient with attacker-controlled subject and body. This happens because the endpoint bypasses origin checks and captcha validation due to being on a CSRF bypass list.

Useful 0 Not Useful 0

Detection Guidance

Check if sendEmail.json.php exists in your AVideo installation and verify if it is included in any CSRF bypass lists. Review server logs for unusual email-sending activity from the contact address, especially with unexpected subject or body content.

Useful 0 Not Useful 0

Impact Analysis

Attackers can trick an authenticated admin into visiting a malicious page, which then sends phishing emails that appear legitimate. These emails pass SPF, DKIM, and DMARC checks, enabling brand impersonation and phishing attacks. The site's sending reputation may also be abused.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to potential unauthorized email transmissions containing sensitive data. Attackers could use the flaw to send phishing emails that appear legitimate, risking data breaches or unauthorized disclosures. GDPR requires protecting personal data, while HIPAA mandates secure handling of health information. Unauthorized email use may violate these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Remove sendEmail.json.php from the CSRF bypass list in your AVideo configuration. Ensure all administrator sessions are logged out and passwords are reset. Monitor outgoing emails for suspicious activity and apply patches if available.

Useful 0 Not Useful 0