CVE-2026-88872 in AVideo
Summary
by MITRE • 09/10/2026
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in the setPassword.json.php endpoint that allows unauthenticated attackers to modify any user's channel password by sending a GET request. Attackers can craft a malicious webpage that, when visited by an authenticated administrator, sets or clears any user's channel password without CSRF token validation.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/10/2026
The identified vulnerability in AVideo represents a critical cross-site request forgery flaw within the setPassword.json.php endpoint, stemming from insufficient verification of the origin and intent of incoming HTTP requests. This security deficiency allows unauthenticated attackers to execute unauthorized state-changing actions on behalf of authenticated users without their knowledge or consent. The root cause lies in the application's failure to implement robust CSRF token validation mechanisms for this specific API endpoint, which is designed to modify user channel passwords. By omitting strict checks that distinguish between legitimate user-initiated requests and maliciously crafted external requests, the system inadvertently trusts any GET request targeting this functionality, regardless of its source or context.
From a technical perspective, the vulnerability exploits the inherent trust browsers place in cookies for session management. When an administrator is authenticated to the AVideo platform, their browser retains valid session credentials that are automatically included with every subsequent request made to the application's domain. An attacker can construct a malicious webpage containing a simple HTML form or JavaScript snippet configured to send a GET request to the vulnerable setPassword.json.php endpoint. Upon visiting this page while logged into AVideo, the browser silently submits the forged request using the administrator’s active session cookies. Because the server does not validate whether the request originated from an authorized origin or included a unique anti-CSRF token, it processes the command as legitimate, thereby allowing the attacker to set or clear any user's channel password without requiring prior authentication for that specific action.
The operational impact of this vulnerability is severe, particularly when exploited against privileged accounts such as administrators. By manipulating passwords through CSRF, an attacker can effectively lock out legitimate users by clearing their existing credentials or gain unauthorized access by setting a known password. This capability undermines the integrity and confidentiality of user data within the platform. In environments where AVideo manages sensitive video content or serves educational institutions, this could lead to significant reputational damage, loss of trust among users, and potential compliance violations related to data protection standards. Furthermore, if an administrator account is compromised via this method, it may serve as a foothold for further lateral movement within the network infrastructure hosting the application.
This vulnerability aligns with CWE-352, which classifies cross-site request forgery attacks where a malicious site tricks a user's browser into sending authenticated requests to a vulnerable web application. Additionally, from an offensive security framework perspective, this technique corresponds to MITRE ATT&CK Tactic TA0001 (Initial Access) and specifically the sub-technique of exploiting trust in cookies for session management. It highlights the importance of implementing robust input validation and state change protection mechanisms across all endpoints that modify user data or system configuration.
To mitigate this risk, developers must enforce strict CSRF token verification on all state-changing operations, particularly those involving sensitive actions like password modification. Implementing SameSite cookie attributes with a value of Strict or Lax can also prevent browsers from sending session cookies in cross-site contexts, thereby neutralizing many common CSRF attack vectors. Additionally, validating the Origin and Referer headers provides an extra layer of defense by ensuring that requests originate only from expected domains. Regular security audits and code reviews focusing on authentication flows and API endpoint protections are essential to identify and remediate such vulnerabilities before they can be exploited in production environments.