CVE-2026-86719: Cross-Site Request Forgery (CSRF) in WWBN AVideo

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 (master) contains a CSRF vulnerability in the CustomizeUser plugin endpoint plugin/CustomizeUser/swapUser.json.php. This endpoint accepts users_id from $_REQUEST and calls User::swapUser() without enforcing POST-only requests or validating CSRF tokens. The global autoCSRFGuard() only protects POST requests to *.json.php, but the action is reachable via GET, allowing cross-origin GET requests (e.g., via <img> tags) to trigger the swap. An attacker can cause an authenticated administrator's session to be swapped with a non-admin user account, causing loss of admin access until the swap is reversed. Attempts to swap to another administrator account are rejected, preventing privilege escalation. The JSON response also discloses the session_id. The CustomizeUser plugin is enabled by default. No patch was available at the time of disclosure.

An attacker can cause an authenticated administrator to lose administrative access by swapping their session with a non-admin user account via a CSRF attack using a cross-origin GET request. This does not allow privilege escalation but can disrupt administrative control. Additionally, the session_id is disclosed in the JSON response, which could aid further attacks. There is no indication of active exploitation in the wild.

No patch was available at the time of publication. Administrators should be aware of this vulnerability and avoid exposing authenticated administrator sessions to untrusted web content that could trigger cross-origin GET requests to the vulnerable endpoint. Monitor vendor advisories for updates or patches addressing this issue.