The vulnerability identified as CVE-2026-35180 affects WWBN AVideo versions 26.0 and prior. It is a CSRF issue (CWE-352) in the admin/customize_settings_nativeUpdate.json.php endpoint, which lacks CSRF token validation. The endpoint writes uploaded logo files to disk before the Object-Relational Mapping (ORM) domain-based security check is performed. Combined with the platform's SameSite=None cookie policy, this allows a cross-origin POST request to overwrite the platform's logo with attacker-controlled content. The CVSS 3.1 base score is 4.3, reflecting a medium impact with no confidentiality or availability impact but limited integrity impact. No patch or official remediation level has been published by the vendor, and the product is not a cloud service.

An attacker can exploit this vulnerability to overwrite the platform's logo with arbitrary content by sending a cross-origin POST request. This results in limited integrity impact, as the logo can be replaced with attacker-controlled images, potentially enabling defacement or social engineering attacks. There is no direct confidentiality or availability impact reported. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider restricting access to the affected endpoint, implementing manual CSRF protections, or adjusting cookie policies to prevent cross-origin requests. Monitor vendor communications for official patches or updates.