CVE-2026-81733: Cross-Site Request Forgery (CSRF) in WWBN AVideo

The vulnerability in WWBN AVideo affects the plugin/Live/myLiveControls.save.json.php endpoint, which accepts customUrl, customMessage, and autoRedirect parameters from $_REQUEST via GET without CSRF protection. The endpoint only verifies that the user is logged in but does not enforce CSRF tokens or origin checks. This allows an attacker to perform unauthorized changes to a streamer's live-channel viewer redirect settings by luring them to a malicious page, potentially redirecting viewers to phishing sites or showing spoofed messages. The vulnerability is present in versions through 30.0 and the master branch up to commit 4cb576e.

An attacker can exploit this CSRF vulnerability to silently modify live-channel viewer redirect settings for logged-in streamers. This can cause viewers to be redirected to phishing sites or shown spoofed messages, potentially leading to phishing attacks or misinformation. The vulnerability requires the victim to be a logged-in streamer and to visit a malicious page controlled by the attacker.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious about visiting untrusted sites while logged in as streamers. Implementing CSRF tokens or origin checks on the affected endpoint is recommended once a patch is released.