CVE-2026-92579 WWBN CVE debrief

Who should care

Defenders responsible for authentication and session management in AVideo installations should assess exposure and validate mechanisms to prevent unauthorized logout. This includes operators managing AVideo deployments, platform administrators, vulnerability management teams, and security teams responsible for ensuring the integrity of authentication and session management mechanisms.

Why it matters

CVE-2026-92579 allows attackers to log out authenticated users in AVideo installations through a CSRF exemption vulnerability. Defenders responsible for authentication and session management in AVideo installations should assess exposure and validate mechanisms to prevent unauthorized logout. The vulnerability's impact on authentication and session management requires verification from official sources, and its exploitation is not confirmed.

• Potential unauthorized logout of authenticated users
• Bypass of authentication mechanisms
• Elevation of access for attackers
• Verification of CSRF exemption mechanisms required

Technical summary

The autoCSRFGuard() function in AVideo through version 29.0 maintains a hardcoded allowlist of exempt basenames without directory context. This allows plugin files matching core filenames to inherit CSRF exemptions. Specifically, the LoginWordPress plugin file login.json.php inherits an exemption and unconditionally logs out authenticated users on cross-site POST requests before validating credentials.

Defensive priority

Medium priority for authentication and session management validation

Recommended defensive actions

• Review and validate authentication and session management mechanisms in AVideo installations
• Assess exposure of AVideo installations to cross-site request forgery attacks
• Verify version of AVideo and apply patches or updates if available
• Monitor for suspicious cross-site POST requests and logout events
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The vulnerability exists in AVideo through version 29.0, specifically in the autoCSRFGuard() function, which maintains a hardcoded allowlist of exempt basenames. The LoginWordPress plugin file login.json.php inherits this exemption, leading to unconditional logout of authenticated users on cross-site POST requests before validating credentials.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.