CVE-2026-34611: CSRF in wwbn/avideo Email Functionality

The primary impact of CVE-2026-34611 is the ability for an attacker to send arbitrary HTML emails to all users of the AVideo platform. This could be leveraged for phishing attacks, spreading malware, or defacing the platform's reputation. Because the emails appear to originate from the legitimate SMTP address, users are more likely to trust them, increasing the likelihood of successful exploitation. The SameSite=None cookie setting exacerbates the risk, as it allows cross-origin requests to include the administrator's session cookie, effectively bypassing CSRF protection. A successful attack could result in widespread user compromise and significant reputational damage to the AVideo platform.

1. Reserved2026-03-30
2. Published2026-04-01
3. EPSS updated2026-04-08

The recommended mitigation for CVE-2026-34611 is to upgrade to a patched version of wwbn/avideo. If an immediate upgrade is not possible, implement temporary workarounds. A Web Application Firewall (WAF) can be configured to block requests to the objects/emailAllUsers.json.php endpoint that lack a valid CSRF token. Additionally, enforce stricter session management policies, such as requiring multi-factor authentication for administrators and implementing short session timeouts. Regularly review and audit administrator activity to detect any suspicious behavior. After upgrading, confirm the fix by attempting to trigger the email functionality from a separate browser session without administrator credentials; the request should be rejected.

Last updated

29.0recently