CVE-2026-34394 is a high-severity Cross-Site Request Forgery (CSRF) vulnerability affecting WWBN AVideo versions 26.0 and prior. The flaw exists due to a lack of CSRF token validation on the admin plugin configuration endpoint, combined with an explicit SameSite=None cookie policy. This allows an attacker to forge cross-origin POST requests, bypassing standard access controls to overwrite arbitrary plugin settings. With a CVSS score of 8.1 (High), successful exploitation could lead to a complete platform takeover, including reconfiguring critical services like payment processors or authentication providers. Currently, there are no publicly available patches or exploit code, and it is not listed in CISA's Known Exploited Vulnerabilities catalog, though it has received minimal community discussion.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 26.0CPE matchmatch criteria | cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.