CVE-2026-88876

AVideo, through revision c3edcc274c389816d434acadac07ee78eaf330c1, contains a missing authorization flaw (CWE-200) in the plugin/PlayerSkins/seo.php endpoint. The getSources() function returns the direct video source URL without checking the password configured for the video, so any unauthenticated remote attacker can request seo.php with a valid video ID and receive the direct MP4 link. The attacker can then read the protected media bytes without ever supplying the video password, gaining unauthorized access to password-protected content (confidentiality impact only, per the CVSS 4.0 vector). Only AVideo operators whose deployments include password-protected videos are materially affected, and only if the affected revision is running. The flaw is not yet listed in CISA's KEV and no public proof-of-concept is known, so there is no confirmed evidence of exploitation at this time.

What to do: Update AVideo to the latest release, i.e., any revision newer than c3edcc274c389816d434acadac07ee78eaf330c1, which restores password validation in plugin/PlayerSkins/seo.php. As an interim mitigation, block or restrict external access to plugin/PlayerSkins/seo.php at the web server or reverse-proxy level. Review access logs for unauthenticated requests to seo.php containing video IDs to check whether password-protected videos were accessed.