Executive brief
WWBN AVideo is a video hosting and streaming platform with a LoginControl plugin that manages user authentication and two-factor authentication. A cross-site request forgery vulnerability in the PGP key management endpoints allows attackers to replace a victim's two-factor authentication key by tricking them into visiting a malicious webpage, leading to account lockout or takeover if the attacker knows the password.
Technical details
The LoginControl plugin's PGP key endpoints (savePublicKey.json.php, deletePublicKey.json.php, and generateKeys.json.php) accept GET requests and fail to validate CSRF tokens or enforce POST-only restrictions. An attacker can craft a malicious page containing an image tag pointing to these endpoints with attacker-controlled parameters; when a logged-in victim loads the page, the browser automatically sends the request with the victim's session credentials, replacing their PGP 2FA key. If two-factor authentication (enablePGP2FA) is enabled, the victim is locked out until they restore a valid key; if the attacker already knows the account password, they can complete the two-factor challenge using the planted key to gain full account access. The vulnerability requires user interaction (victim visiting a malicious page) but affects all users of affected AVideo installations with LoginControl enabled. No patch was available at time of advisory publication.
Affected products
- WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1
Timeline
- 2026-08-26: disclosed: GitHub Security Advisory GHSA-g4x9-vh2j-h7rj published
- 2026-09-10: advisory: CVE-2026-88870 published on NVD