WWBN AVideo up to version 29.0 has multiple JSON endpoints under 'objects/' that accept state-changing requests via $_REQUEST/$_GET without any anti-CSRF token, origin, or referer validation. This allows an attacker to exploit CSRF by tricking a logged-in user into loading attacker-controlled HTML, which can silently perform actions such as flipping comment likes, posting comments as the victim, or deleting category assets if permitted. The vulnerability is tracked as CVE-2026-40928 and classified under CWE-352. A code commit (7aaad601bd9cd7b993ba0ee1b1bea6c32ee7b77c) contains a fix, but no official vendor patch advisory is referenced.

Exploitation allows an attacker to cause a victim user to perform unintended actions on the AVideo platform without their consent. This includes modifying likes/dislikes on comments, posting arbitrary comments under the victim's identity, and deleting assets from categories if the victim has management rights. The impact affects integrity and availability of user content and platform assets. There is no indication of confidentiality impact. The CVSS score is 5.4 (medium severity). No known exploits in the wild have been reported.

A fix has been committed in the source code repository (commit 7aaad601bd9cd7b993ba0ee1b1bea6c32ee7b77c) addressing the CSRF vulnerability. However, no official patch release or vendor advisory is currently available. Users should apply the fix from the commit or update to a version including this fix once released. Until then, consider implementing manual CSRF protections or restricting access to affected endpoints. Patch status is not yet confirmed — check the vendor advisory or repository for current remediation guidance.