VULNERABILITY INTELLIGENCE
CVE-2026-81733
EPSS probability0.22%
CISA KEVNot currently listed
Published2026-08-28
Last modified2026-08-29
Description
WWBN AVideo through 30.0 (and master up to commit 4cb576e) contains a cross-site request forgery vulnerability in plugin/Live/myLiveControls.save.json.php. The endpoint only checks that a user is logged in and processes customUrl, customMessage, and autoRedirect parameters from $_REQUEST via a GET request without enforcing a CSRF token or origin check. An attacker who lures a logged-in streamer to a malicious page can silently change the live-channel viewer-redirect settings (persisted in users.externalOptions), causing viewers to be redirected to a phishing site or shown a spoofed message.
Weakness classification
- disclosure@vulncheck.com: CWE-352