CVE-2026-35181 WWBN CVE debrief

Who should care

Users of WWBN AVideo version 26.0 and prior should be aware of this vulnerability, as it allows an attacker to modify the video player appearance on the entire platform via a cross-origin POST request.

Technical summary

The player skin configuration endpoint at admin/playerUpdate.json.php in WWBN AVideo versions 26.0 and prior does not validate CSRF tokens. The plugins table is explicitly excluded from the ORM's domain-based security check via ignoreTableSecurityCheck(), removing the only other layer of defense. Combined with SameSite=None cookies, a cross-origin POST can modify the video player appearance on the entire platform.

Defensive priority

Medium priority, as the vulnerability has a CVSS score of 4.3 and allows for modification of the video player appearance. Given the SameSite=None cookies configuration, defenders should prioritize verifying and applying vendor remediation, implementing compensating controls, and monitoring for potential attacks with increased scrutiny, especially in environments with high-risk exposure or sensitive data handled by AVideo platforms. Additionally, reviewing and enhancing the security configuration of AVideo deployments to prevent similar cross-origin request vulnerabilities is crucial. This may involve updating cookie settings, enhancing CSRF protection mechanisms, and ensuring that all components of the platform are up-to-date and patched against known vulnerabilities. The vulnerability's impact on the video player appearance across the entire platform suggests that defenders should also focus on monitoring for and responding to potential aesthetic or functional changes that could indicate exploitation attempts or successful attacks. Prioritizing these defensive measures will help mitigate the risk associated with this vulnerability and protect against potential attacks that could leverage this weakness in AVideo deployments. The medium priority indicates that while immediate action is not mandated, proactive steps should be taken to address this vulnerability before it can be exploited in a real-world attack scenario. Therefore, defenders should allocate appropriate resources to verify AVideo versions, assess exposure, apply mitigations, and monitor for suspicious activities related to video player modifications, ensuring a robust defense against potential threats exploiting this vulnerability in AVideo platforms. Furthermore, considering the potential for cross-origin POST requests to modify the video player appearance, defenders should also focus on enhancing network and application security controls to detect and prevent such malicious activities effectively. This may involve implementing web application firewalls (WAFs) with rules tailored to detect and block suspicious cross-origin requests, as well as enhancing logging and monitoring capabilities to detect

Recommended defensive actions

• Verify and apply vendor remediation for AVideo version 26.0 and prior.
• Implement compensating controls, such as validating CSRF tokens for the player skin configuration endpoint.
• Monitor for and track exceptions related to video player appearance modifications.
• Perform inventory checks to ensure AVideo versions are up-to-date.
• Consider implementing additional security measures, such as SameSite cookies.

Evidence notes

The CVE record and NVD detail provide information on the vulnerability, including its CVSS score and vector. The GitHub security advisory provides additional context on the vulnerability and mitigation steps. Evidence limits suggest that further verification is needed to confirm affected scope and severity. Defenders should verify AVideo versions and configurations, review compensating controls, and monitor for exceptions related to video player appearance modifications.

Official resources