CVE-2026-88876 in AVideo
Summary
by MITRE • 09/10/2026
AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in plugin/PlayerSkins/seo.php that allows unauthenticated attackers to access password-protected video sources by calling getSources() without password validation. Attackers can request the seo.php endpoint with a video ID to obtain the direct MP4 URL and read protected media bytes without supplying the configured password.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/10/2026
The vulnerability identified in AVideo, specifically within the PlayerSkins plugin component at revision c3edcc274c389816d434acadac07ee78eaf330c1, represents a critical failure in access control mechanisms. This flaw is categorized under CWE-285, which describes Improper Authorization, and aligns with the ATT&CK technique T1078, Valid Accounts, as it allows an attacker to bypass authentication controls intended for specific resources. The core issue resides in the seo.php file located within the plugin/PlayerSkins directory. This endpoint is designed to handle search engine optimization requests by providing metadata or direct links to video content. However, the implementation fails to enforce password protection checks when invoking the getSources() function. In a properly secured system, any request for media sources that are marked as private or password-protected must undergo strict validation of user credentials before returning sensitive data such as direct file paths or binary streams.
From a technical perspective, the vulnerability stems from an incomplete implementation of access control logic within the PHP script handling SEO requests. When an unauthenticated attacker sends a request to the seo.php endpoint with a specific video ID, the application retrieves the source information via getSources() without verifying whether the requesting user has provided the correct password associated with that video. This oversight means that the authentication gate is effectively bypassed at the API level rather than just the UI level. The system assumes that because the request comes through an SEO-friendly endpoint, it does not require strict session or credential validation for protected content. Consequently, the server returns the direct MP4 URL and allows the reading of protected media bytes without any prior authentication step. This behavior exposes a significant gap in the security architecture where resource-level permissions are decoupled from the request processing logic.
The operational impact of this vulnerability is severe, particularly for platforms hosting sensitive or copyrighted material. Attackers can exploit this flaw to access password-protected videos that were intended to be restricted to authorized users only. This leads directly to data leakage and unauthorized distribution of media content. For businesses relying on AVideo for monetization through pay-per-view or subscription models, this vulnerability undermines the revenue protection mechanisms by allowing free access to premium content. Furthermore, if the protected videos contain personally identifiable information or confidential corporate communications, the exposure could lead to regulatory compliance violations such as GDPR or HIPAA breaches depending on the nature of the data. The ability to retrieve direct MP4 URLs also facilitates further attacks, including bandwidth exhaustion through automated downloading scripts or potential injection attempts if the URL parameters are not properly sanitized in downstream processes.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. Immediately, administrators should apply the patch associated with revision c3edcc274c389816d434acadac07ee78eaf330c1 or later versions where this authorization check has been corrected to validate passwords before returning source data. In addition to updating software, it is crucial to implement defense-in-depth measures such as Web Application Firewalls that can detect and block anomalous requests to the seo.php endpoint lacking valid session tokens. Developers should also conduct a thorough code review of all endpoints handling media sources to ensure consistent application of CWE-285 principles across the entire platform. Enforcing strict input validation and ensuring that every API call, regardless of its intended purpose like SEO optimization, verifies user permissions against the resource's access control list is essential. Regular security audits and penetration testing focusing on broken object level authorization flaws will help maintain robust protection for protected media assets.