WWBN AVideo has CSRF in configurationUpdate.json.php Enables Full Site Configuration Takeover Including Encoder URL and SMTP Credentials
Date: 2026-04
Affected: composer/wwbn/avideo
Attack vector: path-traversal
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-40925
CWE: CWE-352
CVSS: 8.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L)

## Summary `objects/configurationUpdate.json.php` (also routed via `/updateConfig`) persists dozens of global site settings from `$_POST` but protects the endpoint only with `User::isAdmin()`. It does not call `forbidIfIsUntrustedRequest()`, does not verify a `globalToken`, and does not validate the Origin/Referer header. Because AVideo intentionally sets `session.cookie_samesite=None` to support cross-origin iframe embedding, a logged-in administrator who visits an attacker-controlled page will have the browser auto-submit a cross-origin POST that rewrites the site's encoder URL, SMTP credentials, site `<head>` HTML, logo, favicon, contact email, and more in a single request. ## Details The entire authorization and CSRF check for the endpoint is this block at `objects/configurationUpdate.json.php:10`: ```php require_once $global['systemRootPath'] . 'objects/user.php'; if (!User::isAdmin()) { die('{"error":"' . __("Permission denied") . '"}'); } ``` Immediately after, `$_POST` values are written straight into the global `AVideoConf` object and persisted: ```php // objects/configurationUpdate.json.php $config = new AVideoConf(); $config->setContactEmail($_POST['contactEmail']); // :21 $config->setLanguage($_POST['language']); // :22 $config->setWebSiteTitle($_POST['webSiteTitle']); // :23 $config->setDescription($_POST['description']); // :24 $config->setAuthCanComment($_POST['authCanComment']); // :25 $config->setAuth


Mitigations:

Architectural layers (MAESTRO):