CVE-2026-81733 WWBN CVE debrief

Who should care

Administrators and users of WWBN AVideo, especially those who manage live channels, should be aware of this vulnerability and take defensive actions to prevent exploitation. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. They should also plan vendor-supported updates or mitigations through normal change control where exposure is confirmed, review compensating controls for exposed systems while remediation is scheduled and verified, and check relevant monitoring, detection, and logs for exposed assets that need extra review. Additionally, they should track exceptions, retest remediated assets, and close the item only after evidence is documented. The vulnerability has a significant impact on the security of live channels, and affected operators, platforms, vulnerability-management, and security teams should take immediate action to mitigate the vulnerability. The vulnerability can be exploited by attackers to silently change live-channel viewer-redirect settings, causing viewers to be redirected to a phishing site or shown a spoofed message. Therefore, it is essential to implement defensive measures to prevent exploitation and minimize potential damage. The affected product deployments should be identified, and an owner should be assigned for follow-up. The vulnerability can be addressed by updating WWBN AVideo to a version that includes a fix for this vulnerability, if available. In the meantime, compensating controls such as restricting access to the affected endpoint and monitoring for suspicious activity can help mitigate the vulnerability. The vulnerability is a high-priority issue that requires immediate attention from administrators and users of WWBN AVideo. The vulnerability can have a significant impact on the security and integrity of live channels, and it is essential to take defensive actions to prevent exploitation. The affected product or component is WWBN AVideo, and the vulnerability class is cross-site request forgery (CSRF). The likely operational impact of the vulnerability is significant, and the source-confidence limits are high. The review context for the CVE record,

Technical summary

The WWBN AVideo plugin/Live/myLiveControls.save.json.php endpoint is vulnerable to cross-site request forgery (CSRF). An attacker can exploit this vulnerability by luring a logged-in streamer to a malicious page, allowing the attacker to silently change live-channel viewer-redirect settings. The endpoint only checks that a user is logged in and processes customUrl, customMessage, and autoRedirect parameters from $_REQUEST via a GET request without enforcing a CSRF token or origin check. This vulnerability can be mitigated by implementing a CSRF token or origin check for the affected endpoint, restricting access to the affected endpoint to only necessary users and systems, and monitoring for suspicious activity related to live-channel viewer-redirect settings.

Defensive priority

Medium-priority defensive actions are recommended due to the CSRF vulnerability in WWBN AVideo, allowing attackers to silently change live-channel viewer-redirect settings.

Recommended defensive actions

• Inventory and verify the WWBN AVideo plugin/Live/myLiveControls.save.json.php endpoint for exposure.
• Implement a CSRF token or origin check for the affected endpoint.
• Monitor for suspicious activity related to live-channel viewer-redirect settings.
• Restrict access to the affected endpoint to only necessary users and systems.
• Update WWBN AVideo to a version that includes a fix for this vulnerability, if available.

Evidence notes

Evidence from official sources indicates a cross-site request forgery vulnerability in WWBN AVideo through 30.0. The vulnerability exists in plugin/Live/myLiveControls.save.json.php, which processes customUrl, customMessage, and autoRedirect parameters without enforcing a CSRF token or origin check.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.