CVE-2026-88870 in AVideo
Summary
by MITRE • 09/10/2026
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in the LoginControl plugin PGP key endpoints that lack CSRF token validation. Attackers can craft malicious pages with image tags pointing to savePublicKey.json.php to replace a logged-in victim's PGP 2FA public key, causing lockout or enabling account takeover if the attacker knows the password.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/10/2026
The vulnerability identified in WWBN AVideo stems from a critical implementation flaw within the LoginControl plugin, specifically affecting the endpoints responsible for managing Pretty Good Privacy (PGP) keys used for two-factor authentication. The root cause is the absence of Cross-Site Request Forgery (CSRF) token validation on these specific API endpoints. In modern web application security architecture, CSRF protections are essential to ensure that state-changing requests originate from legitimate users interacting with the intended service rather than being triggered by malicious third-party sites. By failing to verify a unique, secret token associated with the user's session for every modification request involving PGP key storage, the application inadvertently trusts any HTTP POST or GET request directed at savePublicKey.json.php, regardless of its origin context.
From a technical perspective, this flaw allows an attacker to construct a malicious webpage containing HTML elements such as image tags that point directly to the vulnerable endpoint. When a victim who is currently authenticated and logged into the AVideo platform visits this malicious page, their browser will automatically include any relevant session cookies in the request sent to savePublicKey.json.php due to standard HTTP cookie handling policies. This results in an unauthorized modification of the user's PGP public key without their knowledge or consent. The attacker effectively hijacks the cryptographic identity associated with the victim's account for two-factor authentication purposes, bypassing the intended security controls that rely on possession of a specific private key corresponding to the registered public key.
The operational impact of this vulnerability is severe and multifaceted. In its most immediate form, it enables denial-of-service against legitimate users by replacing their PGP keys with ones controlled exclusively by the attacker. This action effectively locks the victim out of their own account because they no longer possess the private key required to generate valid authentication tokens for login attempts. Furthermore, if an adversary has already obtained or guessed the user's static password through other means such as phishing or credential stuffing, this vulnerability facilitates full account takeover. The attacker can log in using the stolen credentials and then use their own PGP public key to authenticate subsequent sessions, thereby maintaining persistent access while evading detection by security systems that monitor for anomalies in login behavior from new devices or locations.
This issue aligns with CWE-352, which defines Cross-Site Request Forgery as a vulnerability where a malicious site causes the user's browser to perform an unwanted action on a trusted site for which they are authenticated. Additionally, it relates to CWE-640, Weak Password Recovery Mechanism for Forgotten Password, in contexts where PGP keys serve as primary recovery or authentication factors. From an offensive security perspective, this vulnerability maps directly to MITRE ATT&CK technique T1556.003, which covers Modifying Application Data via Cross-Site Request Forgery. It also intersects with T1078, Valid Accounts, particularly when the attacker leverages stolen credentials in conjunction with the key replacement to establish persistent access.
To mitigate this vulnerability, developers must implement robust CSRF protection mechanisms across all state-changing endpoints within the LoginControl plugin and broader application suite. This includes generating unique, unpredictable per-user tokens that are embedded in forms or custom headers for every request modifying sensitive data like PGP keys. The server-side logic must strictly validate these tokens before processing any changes to user authentication configurations. Additionally, implementing SameSite cookie attributes can provide an additional layer of defense by restricting how browsers send cookies with cross-site requests. Regular security audits and static code analysis focused on identifying endpoints lacking proper request validation are recommended to prevent similar flaws in future updates or other plugins within the AVideo ecosystem.