CVE-2026-40929 | WWBN AVideo up to 29.0 JSON Endpoint commentDelete.json.php forbidIfIsUntrustedRequest cross-site request forgery (GHSA-8qm8-g55h-xmqr)

A vulnerability was found in WWBN AVideo up to 29.0. It has been declared as problematic. This affects the function forbidIfIsUntrustedRequest of the file objects/commentDelete.json.php of the component JSON Endpoint. The manipulation results in cross-site request forgery.

This vulnerability is reported as CVE-2026-40929. The attack can be launched remotely. No exploit exists.

A patch should be applied to remediate this issue.