CVE-2026-83595: Wwbn Avideo

High severity, CVSS 8.1. EPSS: 0.2% chance of exploitation in the next 30 days.

AVideo contains a cross-site request forgery vulnerability in plugin/API/set.json.php that allows attackers to perform state-changing actions by crafting GET requests that bypass CSRF protection. Attackers can navigate a victim's browser to a malicious URL with API parameters to delete videos, deactivate accounts, or modify playlists without user interaction.

Affected products

• Wwbn Avideo: up to and including 29.0

Published 2026-09-01. Last modified 2026-09-08.