CVE-2026-92579

Katalog CVE

CVSS 5.4 · Medium EPSS 0,27%

Kerentanan Authentication Bypass by Alternate Name. Skor CVSS 3.1 5.4 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

In AVideo through 29.0, the autoCSRFGuard() function maintains a hardcoded allowlist of exempt basenames tested without directory context, allowing plugin files matching core filenames to inherit CSRF exemptions. The LoginWordPress plugin file login.json.php inherits an exemption and unconditionally logs out authenticated users on cross-site POST requests before validating credentials.

Rincian

Terbit di NVD

16 September 2026

Terakhir diubah

22 September 2026

Status NVD

Deferred

CVSS 3.1

5.4 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-289: Authentication Bypass by Alternate Name

EPSS (30 hari)

0,27% peluang dieksploitasi; lebih tinggi dari 17,8% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/WWBN/AVideo/security/advisories/GHSA-3hg6-6x7m-5xr8
• https://www.vulncheck.com/advisories/avideo-through-29.0-broken-access-control-via-csrf-exemption-basename-col...