Cross-site request forgery in AVideo - CVE-2026-40928
Published: November 11, 2026
Vulnerability identifier: #VU165907
CSH Severity: Medium
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-40928
CWE-ID: CWE-352
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to force comment creation, manipulate comment votes, and delete category assets through a victim's session.
The vulnerability exists due to missing cross-site request forgery protection in AVideo's state-changing JSON endpoints when processing session-authenticated GET requests without token or origin validation. A remote attacker can trick a logged-in victim into loading a page containing crafted image requests or form submissions to post comments, change votes, or delete category assets if the victim has category management rights.
Affected software
AVideo
How to mitigate CVE-2026-40928
Install security update from vendor's website.
AVideo - update to 29.1.0