CVE-2026-34613 WWBN CVE debrief

Who should care

Administrators and users of WWBN AVideo versions 26.0 and prior should be aware of this vulnerability and take steps to mitigate it. This includes verifying and applying vendor patches or updates, implementing CSRF token validation for the pluginSwitch.json.php endpoint, restricting access to the pluginSwitch.json.php endpoint, and monitoring for suspicious activity related to plugin changes.

Technical summary

The AVideo endpoint objects/pluginSwitch.json.php allows administrators to enable or disable any installed plugin. The endpoint checks for an active admin session but does not validate a CSRF token. Additionally, the plugins database table is explicitly listed in ignoreTableSecurityCheck(), which means the ORM-level Referer/Origin domain validation in ObjectYPT::save() is also bypassed. Combined with SameSite=None on session cookies, an attacker can disable critical security plugins (such as LoginControl for 2FA, subscription enforcement, or access control plugins) by luring an admin to a malicious page.

Defensive priority

Medium priority due to the potential for significant impact on security

Recommended defensive actions

• Verify and apply vendor patches or updates
• Implement CSRF token validation for the pluginSwitch.json.php endpoint
• Restrict access to the pluginSwitch.json.php endpoint
• Monitor for suspicious activity related to plugin changes
• Consider implementing additional security controls for AVideo installations
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-03-31T21:16:31.447Z and was last modified on 2026-07-24T20:10:00.147Z. The NVD entry is currently Analyzed. There are no publicly available patches at the time of publication. The vulnerability affects WWBN AVideo versions 26.0 and prior.

Official resources