CVE-2026-81733 | BDVDB-2026-366138 Detail

Description#

WWBN AVideo through 30.0 (and master up to commit 4cb576e) contains a cross-site request forgery vulnerability in plugin/Live/myLiveControls.save.json.php. The endpoint only checks that a user is logged in and processes customUrl, customMessage, and autoRedirect parameters from $_REQUEST via a GET request without enforcing a CSRF token or origin check. An attacker who lures a logged-in streamer to a malicious page can silently change the live-channel viewer-redirect settings (persisted in users.externalOptions), causing viewers to be redirected to a phishing site or shown a spoofed message.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-08-28Record published in the CVE List.
2. Version 22026-08-29Most recent update recorded in the CVE List.