CVE-2026-88876: AVideo PlayerSkins seo.php Missing Authorization Password-Protected VOD
AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in plugin/PlayerSkins/seo.php that allows unauthenticated attackers to access password-protected video sources by calling getSources() without password validation. Attackers can request the seo.php endpoint with a video ID to obtain the direct MP4 URL and read protected media bytes without supplying the configured password.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict access to the AVideo PlayerSkins seo.php endpoint (e.g., block/limit unauthenticated traffic at the web server/WAF/ACL) to prevent unauthenticated callers from invoking getSources() and retrieving direct MP4 URLs for password-protected VOD.
Event History
Frequently Asked Questions
Who is exposed to this issue?
AVideo deployments using the PlayerSkins plugin are exposed if they serve password-protected video-on-demand content. The issue affects AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1.
What does an attacker need to exploit it?
An attacker does not need authentication, privileges, or user interaction. They need to request the PlayerSkins seo.php endpoint with a video ID, which can return the direct MP4 URL without validating the configured video password.
What data can be accessed?
The vulnerability exposes the direct MP4 URL for password-protected videos and allows the attacker to read the protected media bytes. The provided information does not indicate impact on integrity or availability.
How can I determine whether protected videos may already be exposed?
Review whether the PlayerSkins seo.php endpoint is reachable and whether password-protected VOD content is configured. Requests to that endpoint using video IDs that result in direct media URLs without a password indicate exposure.