5.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-45610

CVE-2026-45610: WWBN AVideo plugin/LoginControl/set.json.php: 2FA toggle endpoint has no CSRF protection, letting an attacker page silently disable a logged-in victim's 2FA

WWBN AVideo is an open source video platform. In 29.0 and earlier, there is a cross-site request forgery vulnerability on the 2FA toggle. plugin/LoginControl/set.json.php accepts POST type=set2FA value=false, calls LoginControl::setUser2FA(User::getId(), false) on the session-authenticated user, and returns. There is no forbidIfIsUntrustedRequest() call, no isTokenValid() check, no X-CSRF-Token/SameSite enforcement, and no re-authentication step. A cross-origin page that the victim visits while logged into the AVideo dashboard issues the POST via a hidden form (or fetch without credentials:"omit") and disables the victim's 2FA in one request.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-45610

CVE-2026-45610:

5.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
WWBN/AVideo	composer	<= 29.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic Cross-Site Request Forgery (CSRF) in the AVideo platform, specifically in the LoginControl plugin. The endpoint plugin/LoginControl/set.json.php allows changing the Two-Factor Authentication (2FA) setting for a logged-in user. The core of the issue is the absence of any CSRF protection mechanism, such as a token validation (forbidIfIsUntrustedRequest() in AVideo's case), before performing the sensitive action of disabling 2FA.

The analysis of the provided information, including the vulnerable code snippet and the suggested patch, confirms this. The vulnerable file plugin/LoginControl/set.json.php directly calls LoginControl::setUser2FA() based on the user-provided type and value from the POST request, without verifying if the request originated from a trusted source. An attacker can create a malicious webpage with a hidden form that sends a POST request to this endpoint. If a logged-in AVideo user visits this page, their browser will automatically include their session cookie, and the request will be processed, disabling their 2FA without their knowledge or consent.

The vulnerable functions identified are:

plugin/LoginControl/set.json.php: This script is the entry point of the attack. It receives the malicious request and fails to implement CSRF protection.
LoginControl::setUser2FA: This function is the one that actually performs the state-changing operation of disabling the 2FA. It is called by the vulnerable script.

During an exploit, a runtime profiler would show the execution starting from plugin/LoginControl/set.json.php and then a call to LoginControl::setUser2FA. Therefore, both are included as vulnerable functions.

Vulnerable functions

LoginControl::setUser2FA

plugin/LoginControl/set.json.php

This function is called to enable or disable 2FA for a user. The vulnerability lies in the fact that this function was called without any CSRF protection, allowing an attacker to disable a user's 2FA by tricking them into visiting a malicious page.

set.json.php

plugin/LoginControl/set.json.php

This is the entry point for the vulnerability. It's a PHP script that processes the request to change the 2FA status. It fails to perform a CSRF check before calling `LoginControl::setUser2FA`, which makes it vulnerable to CSRF attacks. A profiler would show this script as the starting point of the execution.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.