CVE-2026-88872

CVE-2026-88872 is a cross-site request forgery flaw (CWE-352) in AVideo's setPassword.json.php endpoint, present in AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1. Because the endpoint changes passwords on GET requests without validating a CSRF token, an unauthenticated attacker can host a malicious webpage that fires the password-change request in the victim's browser whenever an authenticated AVideo administrator visits it. This allows the attacker to set or clear any user's channel password, potentially taking control of a channel or locking out its legitimate owner. Any deployment running an affected AVideo build is exposed; there is currently no public proof-of-concept, the issue is not in CISA's KEV catalog, and no exploitation has been reported.

What to do: Update AVideo to a build newer than commit c3edcc274c389816d434acadac07ee78eaf330c1 as soon as a patched release is available, since no fixed version is named in the advisory data. Until then, administrators should avoid clicking untrusted links while logged into AVideo and audit user channel passwords for unexpected changes or clears. Operators of exposed instances could also harden setPassword.json.php by requiring CSRF token validation or restricting direct access to it.