Live › vulnerability › CVE-2026-114048
Go to dashboardWWBN AVideo versions before 24.0 have legacy endpoints such as playlistStatus.php that skip the CSRF check applied only to .json.php files. A logged-in user who opens a malicious page can be made to change private playlists to public, remove playlist videos, or forge video suggestions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted AVideo instances before 24.0 with logged-in users are exposed, because the forged request rides on the user's existing session. Sites that do not run AVideo can skip this entry.
No product ranges from the sources yet.
version.php or admin dashboard; anything below 24.0 is in scope.playlistStatus.php is reachable on the deployment.24.0 or later.playlistStatus.php.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
WWBN AVideo before 24.0 contains a cross-site request forgery vulnerability in legacy endpoints like playlistStatus.php that bypass the .json.php-only autoCSRFGuard() check. Attackers can lure logged-in users to a page with an auto-submitting form to make private playlists public, remove playlist videos, or forge video suggestions.
This page as .md · .json · in your agent: get_signal("CVE-2026-114048")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.