CVE-2026-86718CWE-352csrf

CVE-2026-86718

High · published September 8, 2026

CVSS v3.1
7.1
EPSS
0%
Percentile
8.9
In the wild
Unconfirmed
What it is

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in deleteHistory.json.php and finishAll.json.php that allows unauthenticated attackers to mutate live history by making GET requests without CSRF token validation. Attackers can craft malicious pages that trigger administrator browsers to delete all live transmission history or mark streams as finished when an admin visits the attacker-controlled site.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
EPSS
0.00196 · 8.9th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2026-09-08T20:18Z
References (3)
https://github.com/WWBN/AVideo/security/advisories/GHSA-gmx5-mhqr-h7rj · [email protected]https://www.vulncheck.com/advisories/wwbn-avideo-cross-site-request-forgery-via-deletehistory-json-php · [email protected]https://github.com/WWBN/AVideo/security/advisories/GHSA-gmx5-mhqr-h7rj · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 10 SEP 03:18Z
    EPSS moved — → 0%
    epss
  • 08 SEP 15:13Z
    WWBN AVideo Cross-Site Request Forgery via deleteHistory.json.php
    cvelistv5