CVE-2026-88870
Deferred Deferred - Pending Action

CSRF in AVideo LoginControl PGP Key Replacement

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: VulnCheck

Description
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in the LoginControl plugin PGP key endpoints that lack CSRF token validation. Attackers can craft malicious pages with image tags pointing to savePublicKey.json.php to replace a logged-in victim's PGP 2FA public key, causing lockout or enabling account takeover if the attacker knows the password.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-88870
EUVD
EUVD-2026-75420

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
wwbn avideo to c3edcc274c389816d434acadac07ee78eaf330c1 (exc)
wwbn avideo *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-88870 is a Cross-Site Request Forgery (CSRF) vulnerability in WWBN AVideo's LoginControl plugin. It affects PGP key endpoints that lack CSRF token validation. Attackers can exploit this by tricking logged-in users into visiting malicious pages with image tags pointing to savePublicKey.json.php, which replaces the victim's PGP 2FA public key. This can cause account lockout or takeover if the attacker knows the password.

Detection Guidance

Check AVideo's LoginControl plugin endpoints for missing CSRF protections. Monitor network traffic for GET requests to savePublicKey.json.php, deletePublicKey.json.php, or generateKeys.json.php from untrusted sources. Review server logs for unusual PGP key modifications or deletions.

Impact Analysis

This vulnerability allows attackers to replace your PGP 2FA public key, leading to account lockout if PGP 2FA is enabled. If the attacker knows your password, they can take over your account. Additionally, admin-level CSRF attacks can modify or delete keys for any user, enabling further unauthorized access.

Compliance Impact

This CSRF vulnerability could lead to unauthorized modification of PGP 2FA public keys, potentially causing account lockout or takeover. For GDPR, this may violate Article 32 (security of processing) due to insufficient protection against unauthorized access. Under HIPAA, it could compromise integrity of protected health information if user accounts are taken over.

Mitigation Strategies

Disable GET requests for PGP key endpoints in the LoginControl plugin. Implement CSRF tokens for all state-changing requests. Restrict access to savePublicKey.json.php, deletePublicKey.json.php, and generateKeys.json.php. Update to the latest AVideo version if a patch is released.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88870. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart