Platform
php
Component
avideo
Fixed in
26.0.1
CVE-2026-34394 describes a Cross-Site Request Forgery (CSRF) vulnerability discovered in AVideo, an open-source video platform. This flaw allows attackers to manipulate plugin settings within the admin interface, potentially leading to unauthorized modifications and control. The vulnerability impacts versions 26.0 and earlier. A fix is available in a later, unconfirmed version.
The core of this vulnerability lies in the lack of CSRF token validation within the admin/save.json.php endpoint. An attacker can craft malicious web pages that, when visited by an authenticated administrator, will silently submit forged POST requests to AVideo. Because the application uses SameSite=None cookies, this allows cross-origin requests. This can be exploited to modify plugin configurations, potentially enabling attackers to inject malicious code, redirect users, or compromise the entire platform. The ignoreTableSecurityCheck() array in objects/Object.php further complicates the situation, as it allows manipulation of plugin tables.
This vulnerability was publicly disclosed on 2026-03-31. There are currently no known public proof-of-concept exploits. The CVSS score of 8.1 (HIGH) indicates a significant risk. It is not currently listed on the CISA KEV catalog. The lack of a public exploit does not diminish the risk, as the vulnerability is relatively straightforward to exploit.
Exploit Status
EPSS
0.02% (4% percentile)
CISA SSVC
The primary mitigation is to upgrade to a patched version of AVideo. Until a patched version is available, implement temporary workarounds. A Web Application Firewall (WAF) can be configured to block suspicious POST requests to the admin/save.json.php endpoint. Carefully review and restrict plugin access and permissions. Consider implementing stricter input validation and output encoding within the application to reduce the attack surface. After upgrading, confirm the fix by attempting to submit a forged POST request to the admin/save.json.php endpoint and verifying that the request is rejected.
Update AVideo to a version later than 26.0, once a patched version is released. Currently, no patches are available, so monitoring WWBN AVideo security updates is recommended. As a temporary measure, a custom CSRF validation can be implemented in the admin/save.json.php endpoint.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-34394 is a Cross-Site Request Forgery (CSRF) vulnerability affecting AVideo versions up to 26.0, allowing attackers to modify plugin settings.
Yes, if you are running AVideo version 26.0 or earlier, you are vulnerable to this CSRF attack.
Upgrade to a patched version of AVideo. Until then, implement WAF rules and restrict plugin access.
There are currently no known active exploits, but the vulnerability is considered high severity.
Refer to the AVideo project's official website and security advisories for updates and mitigation guidance.
CVSS Vector
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.