CVE-2026-40925

OVERVIEW CVE-2026-40925 affects WWBN AVideo version 29.0 and earlier. The vulnerability exists in the configurationUpdate.json.php endpoint, which improperly handles global site configuration updates by accepting POST requests that lack adequate CSRF protections. The endpoint fails to implement cross-site request forgery (CSRF) mitigations, including missing globalToken validation and Origin/Referer header checks, despite the application intentionally disabling SameSite cookie restrictions to support cross-origin functionality. SEVERITY The vulnerability carries a CVSS 3.1 score of 8.3 (HIGH) with a network-based attack vector requiring low complexity and user interaction. An unauthenticated attacker can exploit this by crafting a malicious webpage that, when visited by a logged-in administrator, automatically submits a cross-origin POST request. This allows unauthorized modification of critical site configurations including SMTP credentials, encoder URLs, HTML head content, logos, favicons, and contact information. The attack has high confidentiality and integrity impacts with some availability risk. EXPLOITATION STATUS There is no evidence of active exploitation in the wild. The EPSS score of 0.00017 indicates this vulnerability ranks lower than 99.96 percent of disclosed CVEs in real-world exploitation likelihood. No public exploit code is currently available, and the vulnerability has not been added to CISA's Known Exploited Vulnerabilities catalog. A patch addressing this issue is available in commit f9492f5e6123dff0292d5bb3164fde7665dc36b4, and administrators should update to version 29.1 or later.