CVE-2026-88870: WWBN AVideo LoginControl PGP Key CSRF via GET Request
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in the LoginControl plugin PGP key endpoints that lack CSRF token validation. Attackers can craft malicious pages with image tags pointing to savePublicKey.json.php to replace a logged-in victim's PGP 2FA public key, causing lockout or enabling account takeover if the attacker knows the password.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Logged-in users of WWBN AVideo instances using the LoginControl plugin's PGP 2FA functionality are exposed if they can be induced to visit an attacker-controlled page. The attack is network-reachable and does not require the attacker to authenticate.
What must an attacker do to exploit it?
The attacker must cause a logged-in victim to load a malicious page containing an image request to savePublicKey.json.php. Because the affected endpoint accepts the request without CSRF token validation, the request can replace the victim's PGP 2FA public key.
What is the practical impact of a successful attack?
Replacing the PGP 2FA public key can lock the victim out of the account. If the attacker also knows the victim's password, the key replacement can enable account takeover.
How can teams determine whether they are affected?
Review whether the deployment includes the AVideo LoginControl plugin and exposes the savePublicKey.json.php PGP key endpoint. Versions through commit c3edcc274c389816d434acadac07ee78eaf330c1 are identified as affected.