CVE-2026-88871
Deferred Deferred - Pending Action

CSRF in AVideo CustomizeUser Plugin

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: VulnCheck

Description
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) contains a cross-site request forgery vulnerability in the CustomizeUser plugin's plugin/CustomizeUser/setSubscribers.json.php endpoint. The script reads users_id and ExtraSubscribers from $_REQUEST and calls User::setExtraSubscribers() without requiring a POST request or a valid CSRF token; autoCSRFGuard() is applied only to POST requests to *.json.php, and the mutation does not pass through ObjectYPT::save()/isUntrustedRequest(), so a cross-origin GET succeeds. An unauthenticated remote attacker who induces a logged-in administrator to load a crafted page (for example an <img> tag pointing at the endpoint) can forge the ExtraSubscribers count displayed on any user's channel. The CustomizeUser plugin is enabled by default, and no patched version was available at the time of reporting.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-88871
EUVD
EUVD-2026-75421

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wwbn avideo to c3edcc274c389816d434acadac07ee78eaf330c1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-88871 is a cross-site request forgery (CSRF) vulnerability in WWBN AVideo's CustomizeUser plugin. The setSubscribers.json.php endpoint accepts user_id and ExtraSubscribers parameters without requiring POST requests or CSRF token validation. This allows an attacker to trick a logged-in administrator into loading a malicious page, which sends a crafted GET request to forge subscriber counts on any user's channel.

Detection Guidance

To detect this CSRF vulnerability, check if your AVideo instance has the CustomizeUser plugin enabled and if the plugin/CustomizeUser/setSubscribers.json.php endpoint accepts GET requests without CSRF token validation. Monitor network traffic for unauthorized GET requests to this endpoint with user_id and ExtraSubscribers parameters.

Impact Analysis

An unauthenticated attacker could manipulate subscriber counts displayed on user channels, potentially creating fake social proof or altering rankings. This requires tricking an admin into visiting a malicious page, such as via an image tag, but does not need direct access to the system.

Compliance Impact

This CSRF vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized modification of user data (ExtraSubscribers count) without proper authentication or audit trails. GDPR requires data integrity and user consent for modifications, while HIPAA mandates strict access controls for protected health information. The lack of CSRF protection undermines these requirements by enabling unauthorized changes to user profiles.

Mitigation Strategies

Disable the CustomizeUser plugin if not needed. If required, restrict access to the setSubscribers.json.php endpoint by enforcing POST requests and CSRF token validation. Update to a patched version if available. Monitor for suspicious GET requests to this endpoint.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88871. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart