# WWBN AVideo has CSRF in configurationUpdate.json.php Enables Full Site Configuration Takeover Including Encoder URL and SMTP Credentials AVideo's configurationUpdate.json.php only checks User::isAdmin() and skips CSRF token/Origin checks, so a cross-origin form rewrites encoder URL, SMTP creds and site head HTML. - Payout: Research - Severity: high - Program: AVideo - Found by: offset - Disclosed: 2026-04-14 - CVE: CVE-2026-40925 - Write-up quality: 7/10 - Original: https://github.com/advisories/GHSA-vvfw-4m39-fjqf - Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-vvfw-4m39-fjqf - Tags: area:web domain:web impact:ato impact:data-leak impact:integrity kind:research platform:ghsa sev:high tech:php technique:source-review vuln:csrf vuln:misconfiguration vuln:xss **Target:** PHP admin config endpoint objects/configurationUpdate.json.php (/updateConfig) **Root cause:** Endpoint authorizes only via User::isAdmin() and omits forbidIfIsUntrustedRequest()/globalToken/Origin checks; session.cookie_samesite is intentionally None for iframe embedding, so cross-origin POSTs carry the admin session. **Steps:** 1. Confirm objects/configurationUpdate.json.php:10 only calls User::isAdmin() with no forbidIfIsUntrustedRequest, verifyToken, globalToken or Origin/Referer check. 2. Note objects/include_config.php:144 sets `ini_set('session.cookie_samesite', 'None')` and peer endpoint objects/userUpdate.json.php:18 does call forbidIfIsUntrustedRequest(). 3. Host evil.html with a `
` containing fields like `encoder_url`, `smtpHost`, `smtpPassword`, `head` and auto-submit via `document.getElementById('x').submit()`. 4. Lure a logged-in admin to the page; browser sends PHPSESSID cross-origin with no preflight (simple content type). 5. Server passes admin check and reaches `$config->save()` at :130, returning `{"status":"1",...}`; verify injected `'>
```