CVE-2026-88872: AVideo CustomizeUser setPassword.json.php CSRF
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in the setPassword.json.php endpoint that allows unauthenticated attackers to modify any user's channel password by sending a GET request. Attackers can craft a malicious webpage that, when visited by an authenticated administrator, sets or clears any user's channel password without CSRF token validation.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this attack?
AVideo instances containing the affected code are exposed when an authenticated administrator can be induced to visit an attacker-controlled webpage. The attacker does not need to authenticate to the AVideo instance.
What does an attacker need to successfully exploit it?
The attacker needs to cause an authenticated administrator's browser to send a crafted GET request to the setPassword.json.php endpoint. Exploitation requires administrator interaction, but no attacker privileges or CSRF token are required.
What can an attacker change through this issue?
An attacker can set or clear the channel password for any user. This can affect the integrity of user channel access settings.