MEDIUM 5.1 NVD
CVE-2026-114048
WWBN AVideo before 24.0 contains a cross-site request forgery vulnerability in legacy endpoints like playlistStatus.php that bypass the .json.php-only autoCSRFG
WWBN AVideo before 24.0 contains a cross-site request forgery vulnerability in legacy endpoints like playlistStatus.php that bypass the .json.php-only autoCSRFGuard() check. Attackers can lure logged-in users to a page with an auto-submitting form to make private playlists public, remove playlist videos, or forge video suggestions.
References
- https://github.com/WWBN/AVideo/security/advisories/GHSA-9pf9-6jr6-fvjr
- https://www.vulncheck.com/advisories/wwbn-avideo-before-24.0-csrf-via-legacy-playlist-and-
This medium severity vulnerability with a CVSS score of 5.1 was published on 2026-10-21 via NVD.
vulnfeed aggregates 18180 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.