Low severity3.5NVD Advisory· Published Oct 21, 2026

CVE-2026-114048

Description

WWBN AVideo before 24.0 contains a cross-site request forgery vulnerability in legacy endpoints like playlistStatus.php that bypass the .json.php-only autoCSRFGuard() check. Attackers can lure logged-in users to a page with an auto-submitting form to make private playlists public, remove playlist videos, or forge video suggestions.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WWBN/Avideollm-fuzzy
Range: <24.0

Patches

Vulnerability mechanics

References

github.com/WWBN/AVideo/security/advisories/GHSA-9pf9-6jr6-fvjrnvd
www.vulncheck.com/advisories/wwbn-avideo-before-24.0-csrf-via-legacy-playlist-and-video-endpointsnvd

News mentions

No linked articles in our index yet.

cvss	0.227
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000