CVE-2026-35181 WWBN AVideo Affected by CSRF on Player Skin Configuration via admin/playerUpdate.json.php

What is CVE-2026-35181?

CVE-2026-35181 is a medium-severity vulnerability in Wwbn Avideo, published on 6 Apr 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the player skin configuration endpoint at admin/playerUpdate.json.php does not validate CSRF tokens. The plugins table is explicitly excluded from the ORM's domain-based security check via ignoreTableSecurityCheck(), removing the only other layer of defense. Combined with SameSite=None cookies, a cross-origin POST can modify the video player appearance on the entire platform.

Weakness: CWE-352

Which versions are affected by CVE-2026-35181?

2 open source packages ship an affected version, including wwbn/avideo. It affects 1 product.

Products include Wwbn Avideo.

How do I fix CVE-2026-35181?

No fix has been published for CVE-2026-35181 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-35181 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-35181 exists.

Other vulnerabilities in Wwbn Avideo

• CVE-2026-40911 WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks Critical 10.0
• CVE-2026-33478 AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection Critical 10.0
• CVE-2022-30534 Command injection in AVideo Critical 9.9
• CVE-2022-30547 Path traversal in AVideo Critical 9.9
• CVE-2022-32572 Command injection in AVideo Critical 9.9

All Wwbn Avideo vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-4q27-4rrq-fx95.