CVE-2026-81733— WWBN AVideo through 30.0 CSRF via myLiveControls.save.json.php
Quick assessment
Affected
WWBN AVideo
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WWBN AVideo 30.0 及之前版本（以及 master 分支上截至 commit 4cb576e 的代码）在 中存在跨站请求伪造（CSRF）漏洞。该接口仅校验用户是否已登录，并通过 GET 请求从 中读取 、 和 参数，但未强制要求 CSRF 令牌或来源检查。攻击者若能将已登录的直播主诱导至一个恶意页面，即可在用户不知情的情况下修改其直播频道的观众重定向设置（该设置保存在 中），从而导致观众被重定向至钓鱼网站，或被展示伪造的消息。
Possible ATT&CK Techniques 1 AI
T1189 · Drive-by Compromise
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-81733
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WWBN AVideo through 30.0 CSRF via myLiveControls.save.json.php
Source: CVE Program / CVE List V5
Vulnerability Description
WWBN AVideo through 30.0 (and master up to commit 4cb576e) contains a cross-site request forgery vulnerability in plugin/Live/myLiveControls.save.json.php. The endpoint only checks that a user is logged in and processes customUrl, customMessage, and autoRedirect parameters from $_REQUEST via a GET request without enforcing a CSRF token or origin check. An attacker who lures a logged-in streamer to a malicious page can silently change the live-channel viewer-redirect settings (persisted in users.externalOptions), causing viewers to be redirected to a phishing site or shown a spoofed message.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
跨站请求伪造(CSRF)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-81733
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-81733
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-81733 (2)
IV. Related Vulnerabilities
Same product: AVideo
-
CVE-2026-81732
WWBN AVideo through 30.0 Information Disclosure via report4. -
CVE-2026-81678
AVideo SSRF Guard Bypass via IPv6 Transition Addresses -
CVE-2026-59808
AVideo Authentication Bypass via Unkeyed Video Hash Disclosu -
CVE-2026-59256
WWBN AVideo Unbound Token Authorization Bypass via Gallery -
CVE-2026-58003
WWBN AVideo Cross-Site Request Forgery via releaseVideoNow.j
Same vendor: WWBN
-
CVE-2026-81732
WWBN AVideo through 30.0 Information Disclosure via report4. -
CVE-2026-81678
AVideo SSRF Guard Bypass via IPv6 Transition Addresses -
CVE-2026-59808
AVideo Authentication Bypass via Unkeyed Video Hash Disclosu -
CVE-2026-59256
WWBN AVideo Unbound Token Authorization Bypass via Gallery -
CVE-2026-58003
WWBN AVideo Cross-Site Request Forgery via releaseVideoNow.j
Same weakness: CWE-352
-
CVE-2026-78610
Dimension CSRF Vulnerability in Administrator Passphrase Cha -
CVE-2026-75814
Ebyte NE2-D11 Cross-Site Request Forgery -
CVE-2026-80210
FrontAccounting through 2.4.20 Cross-Site Request Forgery on -
CVE-2026-81273
WordPress FluentBooking Pro plugin <= 2.2.4 - Cross Site Req -
CVE-2026-81271
WordPress GeoDirectory plugin <= 2.8.176 - Cross Site Reques
V. Comments for CVE-2026-81733
No comments yet