# CVE-2026-40925 > Vulnerability · severity: **HIGH** (CVSS 8.3). ## Description WWBN AVideo is an open source video platform. In versions 29.0 and prior, `objects/configurationUpdate.json.php` (also routed via `/updateConfig`) persists dozens of global site settings from `$_POST` but protects the endpoint only with `User::isAdmin()`. It does not call `forbidIfIsUntrustedRequest()`, does not verify a `globalToken`, and does not validate the Origin/Referer header. Because AVideo intentionally sets `session.cookie_samesite=None` to support cross-origin iframe embedding, a logged-in administrator who visits an attacker-controlled page will have the browser auto-submit a cross-origin POST that rewrites the site's encoder URL, SMTP credentials, site `` HTML, logo, favicon, contact email, and more in a single request. Commit f9492f5e6123dff0292d5bb3164fde7665dc36b4 contains a fix. ## Key facts - **CVE ID:** CVE-2026-40925 - **Published:** 2026-04-21 - **CVSS severity:** HIGH - **CVSS base score:** 8.3 - **CWE codes:** CWE-352 ## Affected products - `wwbn:avideo` ## Primary sources - NIST NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-40925 ## Citation > AI Analytics. CVE-2026-40925. Retrieved 2026-07-16 from https://api.ai-analytics.org/cve/CVE-2026-40925. Derived from NIST NVD. Licensed CC0. --- *[Dataset catalog](https://api.ai-analytics.org/datasets/) · [AI Analytics](https://api.ai-analytics.org/) · CC0 1.0*