CVE-2026-88871 in AVideo
Summary
by MITRE • 09/10/2026
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) contains a cross-site request forgery vulnerability in the CustomizeUser plugin's plugin/CustomizeUser/setSubscribers.json.php endpoint. The script reads users_id and ExtraSubscribers from $_REQUEST and calls User::setExtraSubscribers() without requiring a POST request or a valid CSRF token; autoCSRFGuard() is applied only to POST requests to *.json.php, and the mutation does not pass through ObjectYPT::save()/isUntrustedRequest(), so a cross-origin GET succeeds. An unauthenticated remote attacker who induces a logged-in administrator to load a crafted page (for example an <img> tag pointing at the endpoint) can forge the ExtraSubscribers count displayed on any user's channel. The CustomizeUser plugin is enabled by default, and no patched version was available at the time of reporting.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/10/2026
The vulnerability identified in WWBN AVideo constitutes a critical cross-site request forgery flaw within the CustomizeUser plugin, specifically targeting the endpoint located at plugin/CustomizeUser/setSubscribers.json.php. This security defect arises from an inconsistent implementation of anti-CSRF protections across different HTTP methods and code paths. While the application attempts to mitigate such attacks by invoking autoCSRFGuard() for POST requests directed at JSON endpoints, this safeguard is bypassed entirely when the same state-changing operation is executed via a GET request. The underlying logic fails to enforce strict method validation or require valid CSRF tokens for all mutation operations, creating a significant gap in access control that allows unauthenticated actors to manipulate server-side state through cross-origin interactions.
From a technical perspective, the root cause lies in how the script processes incoming requests without adequate verification of their origin or intent. The endpoint reads parameters such as users_id and ExtraSubscribers directly from the $_REQUEST superglobal array, which aggregates data from GET, POST, COOKIE, and other sources. Crucially, the function User::setExtraSubscribers() is called without verifying that the request originated from a legitimate session context protected by a CSRF token. Furthermore, the mutation does not pass through ObjectYPT::save() or its associated isUntrustedRequest() check, which would typically provide an additional layer of validation against untrusted inputs. This architectural oversight means that any cross-origin GET request can successfully alter subscriber counts without triggering security mechanisms designed to prevent such unauthorized modifications.
The operational impact of this vulnerability allows a remote attacker to forge requests on behalf of authenticated administrators with minimal effort. By inducing a logged-in administrator, particularly one with elevated privileges, to load a malicious webpage containing an image tag or similar element pointing at the vulnerable endpoint, the attacker can manipulate the ExtraSubscribers count displayed on any user's channel profile. Since the CustomizeUser plugin is enabled by default in many installations and no patched version was available at the time of reporting, this flaw presents a widespread risk to platform integrity. The ability to arbitrarily alter subscriber counts undermines trust metrics, potentially affecting content visibility algorithms, monetization structures, and overall community engagement dynamics within the video hosting environment.
This vulnerability aligns with CWE-352, which describes cross-site request forgery as an attack that forces an end user to execute unwanted actions on a trusted web application in which they are currently authenticated. In terms of offensive security frameworks, this exploit maps directly to MITRE ATT&CK technique T1089, known as Disabling Security Tools or Tampering with Application Settings, specifically under the sub-technique related to modifying configuration settings via forged requests. The attack vector leverages social engineering principles by tricking users into initiating actions they did not intend, exploiting the browser's automatic inclusion of session cookies in cross-origin requests.
To mitigate this risk, immediate remediation should focus on enforcing strict HTTP method validation at the endpoint level, ensuring that state-changing operations are exclusively permitted via POST or PUT methods rather than GET. Additionally, implementing robust CSRF token verification for all endpoints handling sensitive user data is essential, regardless of whether they serve JSON responses. Developers must also ensure that all code paths involving user modification pass through comprehensive security checks like ObjectYPT::save() to maintain consistent validation standards across the application. Until patches are deployed, administrators should consider restricting access to administrative interfaces and monitoring for unusual spikes in subscriber count modifications as a temporary defensive measure against exploitation attempts.