CVE-2026-81733 WWBN AVideo through 30.0 CSRF via myLiveControls.save.json.php
An attacker can trick a logged-in streamer into changing live-channel redirect settings, potentially redirecting viewers to phishing sites.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-81733?
CVE-2026-81733 is a medium-severity vulnerability in WWBN AVideo, published on 28 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
WWBN AVideo through 30.0 (and master up to commit 4cb576e) contains a cross-site request forgery vulnerability in plugin/Live/myLiveControls.save.json.php. The endpoint only checks that a user is logged in and processes customUrl, customMessage, and autoRedirect parameters from $_REQUEST via a GET request without enforcing a CSRF token or origin check. An attacker who lures a logged-in streamer to a malicious page can silently change the live-channel viewer-redirect settings (persisted in users.externalOptions), causing viewers to be redirected to a phishing site or shown a spoofed message.
Weakness: CWE-352
Which versions are affected by CVE-2026-81733?
How do I fix CVE-2026-81733?
No fix has been published for CVE-2026-81733 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-81733 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-81733 exists.
Sources
Also known as GHSA-mqr3-w6qc-2c4f, GHSA-wpr3-456q-6vgc.