CVE-2026-81733: Wwbn Avideo

Medium severity, CVSS 5.1. EPSS: 0.2% chance of exploitation in the next 30 days.

WWBN AVideo through 30.0 (and master up to commit 4cb576e) contains a cross-site request forgery vulnerability in plugin/Live/myLiveControls.save.json.php. The endpoint only checks that a user is logged in and processes customUrl, customMessage, and autoRedirect parameters from $_REQUEST via a GET request without enforcing a CSRF token or origin check. An attacker who lures a logged-in streamer to a malicious page can silently change the live-channel viewer-redirect settings (persisted in users.externalOptions), causing viewers to be redirected to a phishing site or shown a spoofed message.

Affected products

• Wwbn Avideo: up to and including 30.0

Published 2026-08-28. Last modified 2026-08-29.