{"id":"CVE-2026-114048","title":"WWBN AVideo before 24.0 CSRF via Legacy Playlist and Video Endpoints","summary":"WWBN AVideo before 24.0 contains a cross-site request forgery vulnerability in legacy endpoints like playlistStatus.php that bypass the .json.php-only autoCSRFGuard() check. Attackers can lure logged-in users to a page with an auto-submi…","severity":"low","cvss":3.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","cvssSource":"cna","cwe":["CWE-352"],"vendor":"WWBN","product":"AVideo","affected":["AVideo < 24.0"],"published":"2026-10-21","updated":"2026-10-21","sourceUpdated":"2026-10-21T00:36:26.222Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-114048","references":[{"url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-9pf9-6jr6-fvjr","label":"GitHub Security Advisory (GHSA-9pf9-6jr6-fvjr)"},{"url":"https://www.vulncheck.com/advisories/wwbn-avideo-before-24.0-csrf-via-legacy-playlist-and-video-endpoints","label":"VulnCheck Advisory: WWBN AVideo before 24.0 CSRF via Legacy Playlist and Video Endpoints"}],"tags":["cve.org"],"ingestedAt":"2026-10-21T01:37:08.044Z","slug":"CVE-2026-114048","body":"## Overview\n\nWWBN AVideo before 24.0 contains a cross-site request forgery vulnerability in legacy endpoints like playlistStatus.php that bypass the .json.php-only autoCSRFGuard() check. Attackers can lure logged-in users to a page with an auto-submitting form to make private playlists public, remove playlist videos, or forge video suggestions.\n\n## Affected\n\n- `AVideo < 24.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":19,"depthScoreParts":{"impact":19.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}