CVE-2026-88876 in AVideo
الملخص
بحسب MITRE • 10/09/2026
AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in plugin/PlayerSkins/seo.php that allows unauthenticated attackers to access password-protected video sources by calling getSources() without password validation. Attackers can request the seo.php endpoint with a video ID to obtain the direct MP4 URL and read protected media bytes without supplying the configured password.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.