CVE-2026-86719 WWBN AVideo CustomizeUser Cross-Site Request Forgery Session Hijacking
An attacker can hijack an administrator's session via CSRF in the CustomizeUser plugin, causing loss of administrative access and disclosing session IDs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-86719?
CVE-2026-86719 is a medium-severity vulnerability in WWBN AVideo, published on 8 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 (master) contains a cross-site request forgery vulnerability in the CustomizeUser plugin endpoint plugin/CustomizeUser/swapUser.json.php. The endpoint takes users_id from $_REQUEST and invokes User::swapUser() without calling forbidIfNotPost() or forbidIfInvalidToken(), and the global autoCSRFGuard() check only runs for POST requests to *.json.php, so the action is reachable via GET. An attacker who causes an authenticated administrator's browser to issue a cross-origin GET (for example via an <img> tag or link) can replace that administrator's session with a non-admin user account, causing the administrator to lose administrative access until the swap is cancelled; swapping to another administrator account is rejected, so this is not privilege escalation. The JSON response also discloses the session_id. The CustomizeUser plugin is enabled by default, and no patch was available at the time of publication.
Weakness: CWE-352
Which versions are affected by CVE-2026-86719?
How do I fix CVE-2026-86719?
No fix has been published for CVE-2026-86719 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-86719 being exploited?
There is no known exploitation of CVE-2026-86719 in the wild and no public exploit code.
Sources
Also known as GHSA-wq3c-2xwg-hmw2, GHSA-xrp7-6w7g-q7fx.