CVE-2026-35181: AVideo: CSRF on Player Skin Configuration via admin/playerUpdate.json.php

April 3, 2026 (updated April 6, 2026)

The player skin configuration endpoint at admin/playerUpdate.json.php does not validate CSRF tokens. The plugins table is explicitly excluded from the ORM’s domain-based security check via ignoreTableSecurityCheck(), removing the only other layer of defense. Combined with SameSite=None cookies, a cross-origin POST can modify the video player appearance on the entire platform.

References

github.com/WWBN/AVideo
github.com/WWBN/AVideo/security/advisories/GHSA-4q27-4rrq-fx95
github.com/advisories/GHSA-4q27-4rrq-fx95
nvd.nist.gov/vuln/detail/CVE-2026-35181

Code Behaviors & Features

Detect and mitigate CVE-2026-35181 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →