Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-86724— AVideo YPTWallet saveBalance.php Cross-Site Request Forgery

Quick assessment

Affected

WWBN AVideo

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WWBN AVideo是WWBN组织开源的一个视频分享与内容管理平台。 WWBN AVideo c3edcc274c389816d434acadac07ee78eaf330c1及之前版本存在跨站请求伪造漏洞，该漏洞源于plugin/YPTWallet/view/saveBalance.php文件缺少令牌验证，容易受到跨站请求伪造攻击，可能允许攻击者仅通过会话Cookie设置任意钱包余额。

CVSS 6.5 · Medium EPSS 0.17% · P6 Updated Sep 10, 2026

Possible ATT&CK Techniques 2 AI

T1122 T1189 · Drive-by Compromise

Affected Version Matrix 1

Vendor	Product	Version Range	Status
WWBN	AVideo	`≤ c3edcc274c389816d434acadac07ee78eaf330c1`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-86724

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

AVideo YPTWallet saveBalance.php Cross-Site Request Forgery

Source: CVE Program / CVE List V5

Vulnerability Description

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in plugin/YPTWallet/view/saveBalance.php that allows attackers to set arbitrary wallet balances by relying only on session cookies without token validation. Attackers can craft a malicious webpage that, when loaded by an administrator, submits a POST request to modify any user's wallet balance to any value.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

跨站请求伪造(CSRF)

Source: CVE Program / CVE List V5

Vulnerability Title

WWBN AVideo 跨站请求伪造漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
WWBN	AVideo	0 ~ c3edcc274c389816d434acadac07ee78eaf330c1	-

II. Public POCs for CVE-2026-86724

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-86724

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-86724 (2)

https://www.cve.org/CVERecord?id=CVE-2026-86724

Same Patch Batch · WWBN · 2026-09-08 · 12 CVEs total

CVE-2026-86723	8.1 HIGH	AVideo LoginControl PGP Authentication Bypass via verifyChallenge
CVE-2026-86720	8.1 HIGH	WWBN AVideo Missing Authorization via resendRestreamer.json.php
CVE-2026-86722	8.1 HIGH	AVideo Authentication Bypass via SQL Cache Invalidation
CVE-2026-86728	7.5 HIGH	AVideo through 29.0 Unauthenticated Disclosure via epg.json.php
CVE-2026-86727	7.5 HIGH	AVideo through 29.0 Information Disclosure via stats.json.php
CVE-2026-86721	7.5 HIGH	AVideo through c3edcc274c Authorization Bypass via Session Cookie
CVE-2026-86729	7.4 HIGH	WWBN AVideo Unrestricted Authentication Attempts via get_api_preauthorize
CVE-2026-86718	7.1 HIGH	WWBN AVideo Cross-Site Request Forgery via deleteHistory.json.php
CVE-2026-86725	7.1 HIGH	AVideo SocialMediaPublisher Missing Authorization via add.json.php
CVE-2026-86726	6.5 MEDIUM	AVideo through 29.0 Information Disclosure via restreamsActive.json.php
CVE-2026-86719	5.4 MEDIUM	WWBN AVideo CustomizeUser Cross-Site Request Forgery Session Hijacking

IV. Related Vulnerabilities

Same product: AVideo

Same vendor: WWBN

Same weakness: CWE-352