CVE-2026-34613

CVE-2026-34613 · AVideo: CSRF on Plugin Enable/Disable Endpoint Allows Disabling Security Plugins

Здесь приведены факты из открытых источников об уязвимостях. Перед обновлением ознакомьтесь с исходным сообщением.

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo endpoint objects/pluginSwitch.json.php allows administrators to enable or disable any installed plugin. The endpoint checks for an active admin session but does not validate a CSRF token. Additionally, the plugins database table is explicitly listed in ignoreTableSecurityCheck(), which means the ORM-level Referer/Origin domain validation in ObjectYPT::save() is also bypassed. Combined with SameSite=None on session cookies, an attacker can disable critical security plugins (such as LoginControl for 2FA, subscription enforcement, or access control plugins) by luring an admin to a malicious page. At time of publication, there are no publicly available patches.

CVSS 6.5 · Средний · EPSS 0,2%

Опубликовано

2026-03-31T20:45:50.839Z

Обновлено

2026-04-01T18:44:06.444Z

Стек: php

Проверьте свой сервер →