Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-92579— AVideo through 29.0 Broken Access Control via CSRF Exemption Basename Collision

Quick assessment

Affected
WWBN AVideo
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 AVideo 29.0 及更早版本中， 函数维护了一个硬编码的豁免基础文件名（basename）白名单，且这些文件名的测试不包含目录上下文，导致与核心文件同名的插件文件能够继承 CSRF 豁免。具体来说，LoginWordPress 插件中的 文件继承了该豁免，在跨站点 POST 请求到达时，会在验证凭证之前无条件地将已认证用户登出。

CVSS 5.4 · Medium

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-92579

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
AVideo through 29.0 Broken Access Control via CSRF Exemption Basename Collision
Source: CVE Program / CVE List V5
Vulnerability Description
In AVideo through 29.0, the autoCSRFGuard() function maintains a hardcoded allowlist of exempt basenames tested without directory context, allowing plugin files matching core filenames to inherit CSRF exemptions. The LoginWordPress plugin file login.json.php inherits an exemption and unconditionally logs out authenticated users on cross-site POST requests before validating credentials.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
使用候选名称进行的认证绕过
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
WWBN AVideo 0 ~ 29.0 -

II. Public POCs for CVE-2026-92579

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-92579

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-92579 (2)

Same Patch Batch · WWBN · 2026-09-16 · 10 CVEs total

CVE-2026-92580 8.8 HIGH AVideo through 29.0 CloneSite Stored Shell Injection via SSH Password CSRF
CVE-2026-92578 8.1 HIGH WWBN AVideo through 29.0 Authentication Bypass via Stored Password Hash
CVE-2026-92577 7.5 HIGH AVideo through 29.0 API get_api_video Broken Access Control via clean_title
CVE-2026-92582 7.1 HIGH AVideo through 29.0 Broken Access Control via videoAddNew.json.php CSRF Bypass
CVE-2026-92583 6.5 MEDIUM AVideo through 29.0 Rate Limit Bypass via Non-Atomic Counter Increment
CVE-2026-92584 6.1 MEDIUM AVideo through 29.0 Stored Cross-Site Scripting via User-Agent Header
CVE-2026-92585 4.3 MEDIUM AVideo through 29.0 Missing Authorization Check via API Like Endpoint
CVE-2026-92581 4.3 MEDIUM AVideo through 29.0 Like Counter Desynchronization via Array Parameter
CVE-2026-92586 4.3 MEDIUM AVideo through 29.0 Missing Authorization via comment API endpoint

IV. Related Vulnerabilities

Same product: AVideo
Same vendor: WWBN
Same weakness: CWE-289

V. Comments for CVE-2026-92579

No comments yet

Leave a comment