CVE-2026-40929: 
PHP vulnerability analysis and mitigation

CVE-2026-40929 is a Cross-Site Request Forgery (CSRF) vulnerability in WWBN AVideo, an open-source video platform, affecting versions 29.0 and prior. The flaw exists in the objects/commentDelete.json.php endpoint, which performs no CSRF validation, allowing an attacker to trick authenticated users with comment deletion privileges into mass-deleting comments simply by visiting a malicious page. It was published on April 21, 2026, with a fix committed shortly after. The CVSS v3.1 base score is 5.4 (Medium) (GitHub Advisory).

The root cause is CWE-352 (Cross-Site Request Forgery): the objects/commentDelete.json.php endpoint mutates state (deletes database rows) without calling forbidIfIsUntrustedRequest(), verifying a CSRF/global token, or checking Origin/Referer headers. Compounding the issue, AVideo intentionally sets session.cookie_samesite=None in objects/include_config.php to support cross-origin iframe embedding, meaning any cross-site request automatically carries the victim's PHPSESSID cookie. The endpoint accepts both GET and POST via $_REQUEST, enabling delivery through <img> tags (GET) or auto-submitting forms and fetch() calls (POST). The authorization check inside Comment::delete() — which verifies the session user has permission — is exactly what CSRF abuses: the victim's session legitimately passes the check (GitHub Advisory, Patch Commit).

Successful exploitation allows an attacker to permanently delete comments on behalf of an authenticated victim without their knowledge or consent. Against a site moderator (Permissions::canAdminComment()), the attacker can wipe every comment on the entire platform, causing severe content integrity and availability damage. Against a video channel owner, the attacker can erase all discussion under that creator's videos — enabling targeted reputation attacks, silencing dissent, or destroying community engagement. No credential compromise is required, and no data is exfiltrated; the attack is purely destructive (GitHub Advisory).

A public proof-of-concept (PoC) is available in the GitHub Security Advisory, including crafted HTML with fetch() loops, <img> tag GET variants, and curl commands demonstrating successful deletion with a cross-origin Origin/Referer header and no CSRF token. The EPSS score is approximately 0.015% (very low), and there is no evidence of in-the-wild exploitation or CISA KEV catalog listing at this time. Exploitation requires user interaction — luring a logged-in victim (moderator, video owner, or comment author) to an attacker-controlled page — but no attacker privileges are needed (GitHub Advisory).

1. Reconnaissance: Identify a target AVideo instance (version ≤ 29.0) and enumerate comment IDs (e.g., by browsing the platform or using sequential integer IDs starting from 1).
2. Identify a high-value victim: Target a site moderator or video channel owner who has broad comment deletion authority, maximizing the destructive impact.
3. Craft the malicious page: Host an attacker-controlled HTML page that uses JavaScript fetch() in a loop to send POST requests to https://victim.example.com/objects/commentDelete.json.php with credentials: 'include' and sequential comments_id values:

<script>
for (let i = 1; i <= 10000; i++) {
  fetch("https://victim.example.com/objects/commentDelete.json.php", {
    method: "POST",
    credentials: "include",
    headers: {"Content-Type": "application/x-www-form-urlencoded"},
    body: "comments_id=" + i
  });
}
</script>

4. Lure the victim: Deliver the malicious page URL to the target via phishing email, forum post, compromised advertisement, or rogue embed link.
5. Trigger mass deletion: When the authenticated victim visits the page, their browser automatically includes the PHPSESSID cookie (due to SameSite=None), and the endpoint processes each deletion request, returning {"status":true,"error":false} for each successful delete.
6. Verify impact: Comments are permanently deleted from the database with no audit trail distinguishing CSRF-triggered deletions from legitimate ones (GitHub Advisory).

• Network: Unusual volume of POST or GET requests to /objects/commentDelete.json.php in a short time window; requests to this endpoint originating with Origin or Referer headers pointing to external/unknown domains.
• Logs: Web server access logs showing rapid sequential requests to commentDelete.json.php with incrementing comments_id or id parameter values; requests from a single session deleting far more comments than typical user behavior.
• Database: Sudden mass deletion of rows in the comments table, particularly if correlated with a single users_id session and occurring outside normal usage hours.
• Application: Unexplained disappearance of large numbers of comments across multiple videos or the entire platform, especially if the affected user (moderator/video owner) reports no intentional deletions (GitHub Advisory).

Apply the fix introduced in commit 184f36b1896f3364f864f17c1acca3dd8df3af27, which adds forbidIfIsUntrustedRequest('commentDelete') to objects/commentDelete.json.php and introduces an automatic CSRF guard (autoCSRFGuard()) in objects/include_config.php that blocks cross-origin POST requests to all *.json.php endpoints by default. Operators should update to a version of AVideo that includes this commit. As a workaround prior to patching, consider restricting access to commentDelete.json.php at the web server level (e.g., requiring same-origin requests via WAF rules) or temporarily disabling comment deletion functionality. Additionally, audit all other objects/*.json.php endpoints that perform state-mutating operations to ensure they also call forbidIfIsUntrustedRequest() (GitHub Advisory, Patch Commit).