Cloud Vulnerability DB
A community-led vulnerabilities database
Register for the AI for Security Summit: Join Figma, Perplexity & Wiz
Vulnerability DatabaseCVE-2026-35181
CVE-2026-35181:
PHP vulnerability analysis and mitigation
Overview
CVE-2026-35181 is a Cross-Site Request Forgery (CSRF) vulnerability in the AVideo open-source video platform (by WWBN) affecting the player skin configuration endpoint admin/playerUpdate.json.php. It affects all versions of AVideo up to and including 26.0. The vulnerability was published on April 1, 2026, and added to the GitHub Advisory Database on April 3, 2026. It carries a CVSS v3.1 base score of 4.3 (Medium) (GitHub Advisory, AVideo Advisory).
Technical details
The root cause is CWE-352 (Cross-Site Request Forgery): the admin/playerUpdate.json.php endpoint directly assigns the player skin from POST data ($pluginDO->skin = $_POST['skin'];) at line 17 without validating any CSRF token. A secondary defense — the ORM's domain-based Referer/Origin check — is explicitly disabled for the plugins table via ignoreTableSecurityCheck(), eliminating the only fallback protection. Compounding the issue, AVideo's session cookies are configured with SameSite=None, which causes the authenticated admin's session cookie to be automatically included in cross-origin POST requests from any third-party website, making exploitation straightforward (GitHub Advisory, AVideo Advisory).
Impact
Successful exploitation allows an unauthenticated attacker to modify the video player skin configuration platform-wide without admin consent, simply by tricking an authenticated administrator into visiting a malicious page. If an invalid skin value is submitted, it may disrupt video playback across the entire platform. The vulnerability can also serve as a component in broader defacement or social engineering campaigns. There is no confidentiality or availability impact in the primary attack scenario, but integrity of the platform's appearance is compromised (GitHub Advisory, AVideo Advisory).
Exploitability
A complete, runnable proof-of-concept (PoC) HTML exploit is publicly available in the GitHub Security Advisory, consisting of a self-submitting HTML form targeting admin/playerUpdate.json.php (AVideo Advisory). Feedly rates the PoC confidence as high, noting it is a concrete, reproducible attack artifact. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.014% (1st percentile), indicating a low current probability of active exploitation (GitHub Advisory).
Exploitation steps
- Reconnaissance: Identify AVideo instances running version 26.0 or earlier that are publicly accessible, using search engines or web scanning tools.
- Verify admin session behavior: Confirm that the target AVideo instance uses
SameSite=Nonecookies, which allows cross-origin requests to carry the admin's authenticated session cookie automatically. - Craft malicious HTML page: Create an HTML page on an attacker-controlled domain containing a hidden form that POSTs to
https://<target>/admin/playerUpdate.json.phpwith a chosenskinvalue, and include a JavaScript auto-submit trigger:
<!DOCTYPE html>
<html>
<body>
<form id="csrf" action="https://<target>/admin/playerUpdate.json.php" method="POST">
<input type="hidden" name="skin" value="attacker_skin_value">
</form>
<script>document.getElementById("csrf").submit();</script>
</body>
</html>- Deliver the link: Send the URL of the malicious page to an authenticated AVideo administrator via phishing email, social media, or another social engineering vector.
- Trigger exploitation: When the admin visits the page, their browser automatically submits the form with their session cookie, causing the platform-wide player skin to be changed without their knowledge or consent (AVideo Advisory).
Indicators of compromise
- Network: Unexpected POST requests to
/admin/playerUpdate.json.phporiginating from unusual Referer headers (external or attacker-controlled domains) or with missing/empty Referer headers. - Logs: Web server access logs showing POST requests to
admin/playerUpdate.json.phpfrom IP addresses not associated with legitimate admin activity, especially with cross-origin Referer values. - Application: Unexplained changes to the video player skin configuration in the AVideo admin panel, particularly if no admin recalls making such a change.
- Cookies/Session: Evidence of authenticated admin sessions being used from unexpected geographic locations or at unusual times, potentially indicating a CSRF attack was triggered during a phishing interaction (AVideo Advisory).
Mitigation and workarounds
As of the advisory publication, no patched version of AVideo has been released (all versions ≤ 26.0 are affected and "Patched versions: None" is listed). The recommended fix is to add CSRF token validation at the start of admin/playerUpdate.json.php before processing POST data: if (!isGlobalTokenValid()) { die('{"error":"Invalid CSRF token"}'); }. Additionally, administrators should remove the ignoreTableSecurityCheck() exclusion for the plugins table to restore ORM-level domain security checks, and reconfigure session cookies to use SameSite=Strict or SameSite=Lax instead of SameSite=None to prevent cross-origin cookie inclusion (GitHub Advisory, AVideo Advisory).
Community reactions
The vulnerability was discovered and reported by aisafe.io (via the aisafe-bot finder) and reported by adrgs, and was published to the WWBN/AVideo repository by DanielnetoDotCom on April 1, 2026 (AVideo Advisory). No significant broader media coverage or notable community commentary beyond the advisory itself has been identified at this time.
Additional resources
Source: This report was generated using AI
Related PHP vulnerabilities:
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management