{"id":"CVE-2026-114048","aliases":[],"title":"WWBN AVideo before 24.0 CSRF via Legacy Playlist and Video Endpoints","titleSource":"VulnCheck","descriptionSource":"VulnCheck","products":[{"vendor":"WWBN","name":"AVideo","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"24.0","versionType":"custom"},{"version":"24.0","status":"unaffected","versionType":"custom"}],"defaultStatus":"unaffected","source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-114048"}],"remediation":[],"description":"WWBN AVideo before 24.0 contains a cross-site request forgery vulnerability in legacy endpoints like playlistStatus.php that bypass the .json.php-only autoCSRFGuard() check. Attackers can lure logged-in users to a page with an auto-submitting form to make private playlists public, remove playlist videos, or forge video suggestions.","severity":"medium","score":5.1,"published":"2026-10-21T00:36:26.222Z","modified":"2026-10-27T21:40:17.592Z","withdrawn":false,"knownExploited":false,"affected":[],"references":["https://github.com/WWBN/AVideo/security/advisories/GHSA-9pf9-6jr6-fvjr","https://www.vulncheck.com/advisories/wwbn-avideo-before-24.0-csrf-via-legacy-playlist-and-video-endpoints"],"sources":[{"name":"CVE","id":"CVE-2026-114048","modified":"2026-10-27T21:40:17.592Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-114048"}],"assessments":[{"source":"VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","score":5.1},{"source":"VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","score":3.5}],"sourceAffected":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T21:00:33.596Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}