PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45610 WWBN CVE debrief

A cross-site request forgery (CSRF) vulnerability exists in WWBN AVideo versions 29.0 and earlier. The endpoint plugin/LoginControl/set.json.php accepts POST requests to disable two-factor authentication (2FA) for the currently authenticated user without requiring CSRF tokens, SameSite cookie enforcement, or re-authentication. An attacker can craft a malicious web page that, when visited by a logged-in victim, submits a forged request to disable the victim's 2FA protection. The vulnerability was published to the NVD on 2026-05-29 and remains under analysis. The GitHub Security Advisory provides the primary technical disclosure.

Vendor
WWBN
Product
AVideo
CVSS
MEDIUM 5.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-29
Original CVE updated
2026-07-21
Advisory published
2026-05-29
Advisory updated
2026-07-21

Who should care

Organizations running WWBN AVideo 29.0 or earlier; security teams responsible for application authentication controls; developers maintaining AVideo deployments.

Technical summary

The plugin/LoginControl/set.json.php endpoint in AVideo 29.0 and earlier processes POST requests to disable 2FA without CSRF token validation, SameSite enforcement, or re-authentication. The endpoint accepts parameters type=set2FA and value=false, then calls LoginControl::setUser2FA(User::getId(), false) on the session-authenticated user. No forbidIfIsUntrustedRequest(), isTokenValid(), or equivalent anti-CSRF mechanism is present. An attacker can exploit this by inducing a logged-in victim to visit a malicious page that submits the forged request, resulting in complete 2FA bypass for subsequent attacks.

Defensive priority

high

Recommended defensive actions

  • Upgrade to a patched version of WWBN AVideo when available from the vendor.
  • Implement CSRF token validation on all state-changing endpoints, particularly those affecting authentication security controls.
  • Apply SameSite cookie attributes to session cookies to mitigate cross-origin request risks.
  • Require re-authentication before allowing changes to 2FA settings.
  • Review access logs for unexpected POST requests to plugin/LoginControl/set.json.php with type=set2FA and value=false.
  • Monitor for subsequent authentication anomalies or account takeover attempts following potential 2FA disablement.

Evidence notes

The NVD record cites GitHub Security Advisory GHSA-3mv2-vmwh-rwfx as the authoritative source. The advisory describes the vulnerable endpoint and the absence of CSRF protections. CVSS 3.1 vector: AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N. CWE-352 (CSRF) and CWE-306 (Missing Authentication for Critical Function) are identified.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45610 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45610

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45610 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45610

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.