CVE-2026-88870

WWBN AVideo, a self-hosted video streaming platform, contains a cross-site request forgery (CWE-352) flaw in the LoginControl plugin's PGP key management endpoints, which do not validate a CSRF token when keys are saved. An attacker can host a malicious web page containing an image tag that points to the victim's savePublicKey.json.php endpoint, causing the victim's browser, when logged into AVideo, to silently replace their registered PGP 2FA public key. This can lock the victim out of two-factor authentication, or enable account takeover if the attacker already knows the victim's password, since they can then pair the account with their own PGP key. Any self-hosted AVideo deployment running a build up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1 that uses the LoginControl plugin's PGP 2FA feature is affected. As of this writing there is no known public proof-of-concept, the issue is not in CISA's KEV catalog, and no in-the-wild exploitation has been reported.

What to do: Update AVideo to a build newer than commit c3edcc274c389816d434acadac07ee78eaf330c1 as soon as a patched release is published, and verify your currently registered PGP 2FA public key has not been altered. Until patched, administrators should avoid browsing untrusted websites while logged into AVideo, restrict access to the LoginControl plugin's PGP endpoints at the web server or reverse-proxy layer, and consider disabling the PGP 2FA feature if unused.