CVE-2026-40929 is a CSRF vulnerability in WWBN AVideo (<= 29.0) affecting the comment deletion JSON endpoint. The endpoint lacks CSRF defenses: it does not call forbidIfIsUntrustedRequest(), verify CSRF tokens, or check Origin/Referer headers. The platform's use of session.cookie_samesite=None causes the victim's PHPSESSID cookie to be sent with cross-site requests, allowing attackers to perform unauthorized comment deletions if the victim is authenticated and authorized. The vulnerability affects site moderators, video owners, and comment authors. A code commit (184f36b1896f3364f864f17c1acca3dd8df3af27) contains a fix, but no official patch release is documented.

An attacker can cause authenticated users with comment deletion privileges to unknowingly delete comments by tricking them into visiting a malicious webpage. This results in unauthorized deletion of comments, impacting integrity and availability of user-generated content. There is no direct confidentiality impact. The CVSS score is 5.4 (medium severity), reflecting low attack complexity but requiring user interaction and no privilege required beyond authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor has committed a fix in the source code repository (commit 184f36b1896f3364f864f17c1acca3dd8df3af27) that adds CSRF protections to the comment deletion endpoint. Until an official patch is released and applied, users should consider restricting comment deletion privileges and avoid visiting untrusted sites while authenticated. Monitor vendor channels for an official update.