CVE-2026-88876
Deferred Deferred - Pending Action

AVideo Missing Authorization in PlayerSkins Plugin

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: VulnCheck

Description
AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in plugin/PlayerSkins/seo.php that allows unauthenticated attackers to access password-protected video sources by calling getSources() without password validation. Attackers can request the seo.php endpoint with a video ID to obtain the direct MP4 URL and read protected media bytes without supplying the configured password.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-88876
EUVD
EUVD-2026-75426

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
wwbn avideo to c3edcc274c389816d434acadac07ee78eaf330c1 (inc)
avideo avideo *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

AVideo has a missing authorization vulnerability in the seo.php file that allows unauthenticated attackers to access password-protected video sources. By calling getSources() without password validation, attackers can request the seo.php endpoint with a video ID to obtain direct MP4 URLs and read protected media bytes without supplying the configured password.

Detection Guidance

Check if the seo.php endpoint is accessible without authentication by sending a GET request to /plugin/PlayerSkins/seo.php with a video ID parameter. If it returns direct MP4 URLs without requiring a password, the system is likely vulnerable.

Impact Analysis

Unauthenticated attackers can bypass password protection for Video on Demand content, access protected media files, and read sensitive information. This could lead to unauthorized access to confidential or proprietary video content.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) and HIPAA (health information privacy) by exposing protected content to unauthorized parties.

Mitigation Strategies

Restrict access to the seo.php endpoint by implementing proper authorization checks or temporarily disabling the SEO plugin path until a patch is available. Monitor network traffic for suspicious requests to this endpoint.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88876. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart