CVE-2026-34394: 
PHP vulnerability analysis and mitigation

CVE-2026-34394 is a Cross-Site Request Forgery (CSRF) vulnerability in WWBN AVideo, an open source video platform, affecting all versions up to and including 26.0. The flaw exists in the admin plugin configuration endpoint (admin/save.json.php), which lacks any CSRF token validation, allowing an attacker to forge cross-origin POST requests that overwrite arbitrary plugin settings when a logged-in administrator visits a malicious page. It was published by DanielnetoDotCom on March 27, 2026, and assigned a CVSS v3.1 base score of 8.1 (High) (GitHub Advisory, AVideo Advisory). No patched version was available at the time of initial publication.

The root cause is CWE-352 (Cross-Site Request Forgery): the admin/save.json.php endpoint processes POST data directly without calling isGlobalTokenValid() or verifyToken(), meaning any cross-origin request bearing a valid session cookie is accepted as legitimate. This is compounded by an explicit SameSite=None cookie policy set in objects/include_config.php (line 135 via ini_set('session.cookie_samesite', 'None')), which causes session cookies to be attached to all cross-origin requests, trivializing CSRF attacks. Additionally, the plugins table is included in the ignoreTableSecurityCheck() array in objects/Object.php (line 529), bypassing ORM-level access controls that protect other tables. Exploitation requires only that an authenticated administrator visit an attacker-controlled page hosting an auto-submitting HTML form targeting the vulnerable endpoint (AVideo Advisory).

Successful exploitation allows an unauthenticated attacker to silently reconfigure any plugin on the AVideo platform by tricking an administrator into visiting a single malicious page. High-impact scenarios include payment hijacking (redirecting PayPal or Stripe payments to attacker-controlled accounts), credential theft (replacing S3 bucket credentials to redirect uploaded media), authentication bypass (pointing LDAP/OAuth plugins at attacker-controlled identity providers), and backdoor installation via persistent plugin configuration changes. Both confidentiality and integrity are rated High, as sensitive credentials and platform functionality can be fully compromised (AVideo Advisory, GitHub Advisory).

A proof-of-concept (PoC) exploit in the form of a self-submitting HTML form is publicly documented in the GitHub security advisory, targeting https://your-avideo-instance.com/admin/save.json.php with specific plugin parameters such as pluginName and paypalReceiverEmail (AVideo Advisory). The EPSS score is approximately 0.014% (3rd percentile), indicating a currently low probability of active exploitation in the wild. No threat actor attribution or CISA KEV catalog listing has been reported as of the time of this report. There is no evidence of in-the-wild exploitation at this time (GitHub Advisory).

1. Reconnaissance: Identify publicly accessible WWBN AVideo instances running version 26.0 or earlier using search engines, Shodan, or Censys. Confirm the admin panel is reachable at /admin/.
2. Craft malicious HTML page: Create an HTML page with a hidden auto-submitting form targeting https://<target-avideo-instance>/admin/save.json.php. Include POST parameters such as pluginName (e.g., PayPal) and the desired overwrite values (e.g., paypalReceiverEmail=attacker@evil.com).
3. Host the page: Deploy the malicious HTML on an attacker-controlled domain accessible from the internet.
4. Deliver the link: Trick a logged-in AVideo administrator into visiting the malicious page via phishing email, social engineering, or embedding the link in a forum/comment.
5. Automatic form submission: Upon page load, the JavaScript (document.getElementById('csrf').submit()) auto-submits the form. Because the session cookie has SameSite=None, it is included in the cross-origin POST request.
6. Plugin configuration overwritten: The admin/save.json.php endpoint processes the forged request without CSRF validation, writing the attacker's values directly to the plugins table (which bypasses ORM security checks via ignoreTableSecurityCheck()).
7. Verify and monetize: The attacker verifies the change (e.g., by monitoring for payments to the hijacked PayPal address or accessing attacker-controlled S3 storage for uploaded media) (AVideo Advisory).

• Network: Unexpected POST requests to /admin/save.json.php originating from unusual referrer domains or with Origin headers pointing to external/unknown domains; cross-origin requests with SameSite=None cookies from non-administrative IP addresses.
• Logs: Web server access logs showing POST requests to /admin/save.json.php with Referer headers from external domains; rapid or repeated plugin configuration changes in application logs without corresponding admin activity.
• Application/Database: Unexpected changes to plugin configuration values in the plugins database table, particularly fields such as paypalReceiverEmail, Stripe API keys, S3 bucket credentials, or LDAP/OAuth provider URLs.
• Admin Panel: Plugin settings (payment processors, cloud storage, authentication providers) modified without a corresponding admin action or change management record (AVideo Advisory).

No official patched version was available at the time of initial publication (all versions ≤ 26.0 are affected); administrators should monitor the AVideo repository for a patch release (GitHub Advisory). As an immediate workaround, add CSRF token validation to admin/save.json.php immediately after the admin check by calling isGlobalTokenValid() and returning an error if validation fails. Additionally, change the session cookie SameSite policy from None to Strict or Lax in objects/include_config.php to prevent cross-origin cookie attachment. Administrators should also audit the ignoreTableSecurityCheck() array in objects/Object.php to ensure the plugins table is subject to appropriate access controls (AVideo Advisory).

The vulnerability was discovered and reported by aisafe.io and credited to researcher adrgs (AVideo Advisory). Brief community discussion was noted on Mastodon via TheHackerWire shortly after disclosure. No significant vendor statement beyond the advisory itself, nor major media coverage, has been identified at this time.