CVE-2026-40928: CSRF in AVideo 1.0.0–29.0

The impact of CVE-2026-40928 is significant due to the ease of exploitation and the potential for widespread impact. An attacker could craft a malicious webpage that, when visited by a logged-in AVideo user, silently executes actions such as altering comment likes/dislikes, posting comments with attacker-controlled text, and even deleting assets if the user possesses the necessary permissions. This could result in reputational damage, data manipulation, and disruption of service. The ability to post comments as the victim opens the door for phishing attacks and spreading misinformation. The blast radius extends to all users of affected AVideo installations, particularly those with administrative or content management privileges.

1. Reserved2026-04-15
2. Published2026-04-21
3. Modified2026-04-22
4. EPSS updated2026-04-29

The primary mitigation for CVE-2026-40928 is to upgrade AVideo to version 29.1 or later, which includes the necessary CSRF protections. If immediate upgrading is not feasible, consider implementing temporary workarounds. These may include implementing strict Content Security Policy (CSP) headers to restrict the sources from which scripts can be executed, and adding referer checks to the vulnerable endpoints. Web Application Firewalls (WAFs) can be configured to detect and block suspicious requests targeting the affected JSON endpoints. After upgrading, verify the fix by attempting to trigger the vulnerable actions from a different browser session or incognito window to confirm that CSRF protection is now in place.