A cross‑site request forgery flaw exists in the configurationUpdate.json.php endpoint of WWBN AVideo. The code uses only User::isAdmin() to protect the endpoint and ignores CSRF mitigations such as forbidIfIsUntrustedRequest, a globalToken, and Origin/Referer headers. Because the application sets session.cookie_samesite=None, a logged‑in administrator can be induced to issue a cross‑origin POST that changes global site settings, including encoder URL, SMTP credentials, header HTML, logo, favicon, and contact email.

The flaw affects versions 29.0 and earlier of the WWBN AVideo open‑source video platform. No later releases have been verified to contain the vulnerability; the fix appears in commit f9492f5e6123dff0292d5bb3164fde7665dc36b4. Systems running affected versions should be upgraded promptly.

The CVSS score of 8.3 indicates high severity, and the vulnerability can be exploited by an attacker without additional privileges beyond an administrator account. EPSS information is unavailable and the issue is not listed in CISA’s KEV catalog, but the absence of CSRF protections combined with the browser’s cookie policy allows a malicious page to automatically submit the takeover request. The operation gives the attacker control over SMTP credentials, encoder URL, and site branding elements.