CVE-2026-40926

OVERVIEW CVE-2026-40926 affects WWBN AVideo, an open-source video platform, in versions 29.0 and earlier. Three admin-only JSON endpoints lack proper Cross-Site Request Forgery (CSRF) token validation despite performing state-changing database operations. An unauthenticated attacker can exploit this by tricking a logged-in administrator into visiting a malicious webpage, allowing unauthorized category creation, modification, deletion, and forced execution of plugin update scripts within the admin's session. SEVERITY The vulnerability carries a CVSS 3.1 score of 7.1 (HIGH) with a network-based attack vector requiring no special privileges or technical complexity. User interaction is required, as the admin must visit an attacker-controlled page. While confidentiality impact is minimal, the vulnerability poses significant integrity risks through unauthorized data manipulation and high availability risks through plugin execution. The EPSS score of 0.00019 indicates relatively low prevalence among known vulnerabilities, though the practical impact on compromised instances is substantial. EXPLOITATION STATUS There is no evidence of active real-world exploitation. The vulnerability has not been added to the Known Exploited Vulnerabilities (KEV) catalog, and it remains inactive on the Hot List. No public exploit code or proof-of-concept details are currently documented in available sources. Community attention appears limited, though organizations running WWBN AVideo should prioritize patching via commit ee5615153c40628ab3ec6fe04962d1f92e67d3e2 as a precautionary measure.