PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45610 WWBN CVE debrief

A cross-site request forgery (CSRF) vulnerability exists in WWBN AVideo versions 29.0 and earlier. The endpoint plugin/LoginControl/set.json.php accepts POST requests to disable two-factor authentication (2FA) for the currently authenticated user without requiring CSRF tokens, SameSite cookie enforcement, or re-authentication. An attacker can craft a malicious web page that, when visited by a logged-in victim, submits a forged request to disable the victim's 2FA protection. The vulnerability was published to the NVD on 2026-05-29 and remains under analysis. The GitHub Security Advisory provides the primary technical disclosure.

Vendor
WWBN
Product
AVideo
CVSS
MEDIUM 5.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-29
Original CVE updated
2026-05-29
Advisory published
2026-05-29
Advisory updated
2026-05-29

Who should care

Organizations running WWBN AVideo 29.0 or earlier; security teams responsible for application authentication controls; developers maintaining AVideo deployments.

Technical summary

The plugin/LoginControl/set.json.php endpoint in AVideo 29.0 and earlier processes POST requests to disable 2FA without CSRF token validation, SameSite enforcement, or re-authentication. The endpoint accepts parameters type=set2FA and value=false, then calls LoginControl::setUser2FA(User::getId(), false) on the session-authenticated user. No forbidIfIsUntrustedRequest(), isTokenValid(), or equivalent anti-CSRF mechanism is present. An attacker can exploit this by inducing a logged-in victim to visit a malicious page that submits the forged request, resulting in complete 2FA bypass for subsequent attacks.

Defensive priority

high

Recommended defensive actions

  • Upgrade to a patched version of WWBN AVideo when available from the vendor.
  • Implement CSRF token validation on all state-changing endpoints, particularly those affecting authentication security controls.
  • Apply SameSite cookie attributes to session cookies to mitigate cross-origin request risks.
  • Require re-authentication before allowing changes to 2FA settings.
  • Review access logs for unexpected POST requests to plugin/LoginControl/set.json.php with type=set2FA and value=false.
  • Monitor for subsequent authentication anomalies or account takeover attempts following potential 2FA disablement.

Evidence notes

The NVD record cites GitHub Security Advisory GHSA-3mv2-vmwh-rwfx as the authoritative source. The advisory describes the vulnerable endpoint and the absence of CSRF protections. CVSS 3.1 vector: AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N. CWE-352 (CSRF) and CWE-306 (Missing Authentication for Critical Function) are identified.

Official resources

The vulnerability was disclosed via GitHub Security Advisory and subsequently indexed by NVD on 2026-05-29.