Is CVE-2026-40929 actively exploited?

No active exploitation of CVE-2026-40929 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-40929 be exploited remotely?

Yes. CVE-2026-40929 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-40929?

CVE-2026-40929 has a CVSS score of 5.4 (MEDIUM).

HOME VULNERABILITIESCVE-2026-40929

MEDIUM

CVE-2026-40929

CWE-352Published: April 21, 2026· Updated: Apr 23, 2026

5.4

CVSS v3.1

EPSS:0.01%probability of exploitation in 30 daysPercentile:3.1th

Official Description

WWBN AVideo is an open source video platform. In versions 29.0 and prior, `objects/commentDelete.json.php` is a state-mutating JSON endpoint that deletes comments but performs no CSRF validation. It does not call `forbidIfIsUntrustedRequest()`, does not verify a CSRF/global token, and does not check `Origin`/`Referer`. Because AVideo intentionally sets `session.cookie_samesite=None` (to support cross-origin embed players), a cross-site request from any attacker-controlled page automatically carries the victim's `PHPSESSID`. Any authenticated victim who has authority to delete one or more comments (site moderators, video owners, and comment authors) can be tricked into deleting comments en masse simply by visiting an attacker page. Commit 184f36b1896f3364f864f17c1acca3dd8df3af27 contains a fix.

NVD Source

Technical Analysis

CVE-2026-40929 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.