WWBN AVideo CVE-2026-88870

The victim must be actively authenticated to the targeted AVideo instance at the time they visit attacker-controlled content. The LoginControl plugin with PGP 2FA must be enabled on the AVideo deployment - this is not the default state for all installations, and instances that do not use PGP 2FA are not exposed to this endpoint's risk. The savePublicKey.json.php endpoint must be reachable from the attacker's delivery vector (i.e., the AVideo instance must be internet-accessible or the attacker must be on the same network). Escalation from lockout to full account takeover requires the attacker to independently know or obtain the victim's account password; the CSRF alone cannot provide credential access. User interaction is limited to visiting a single attacker-controlled page or loading embedded content (e.g., an email with a tracking pixel).

The CVSS 4.0 score of 7.1 (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:L) correctly captures the primary exploitation constraint - passive user interaction is required - but the VI:N rating appears inconsistent with the actual attack mechanics: replacing a cryptographic authentication key stored by the application is a clear integrity modification of the vulnerable system's data, suggesting the vector understates integrity impact. EPSS data was not provided, and there is no CISA KEV listing, so no evidence of active exploitation is available. No public exploit code has been identified. The attack is technically simple (embed a URL in an image tag) and fully automatable, making phishing campaigns plausible at scale; even a mid-sized municipal IT team in mielec operating a self-hosted AVideo instance should treat this as a meaningful risk if administrators rely on PGP 2FA for privileged accounts. The full account-takeover scenario is bounded by a significant prerequisite: the attacker must independently know the victim's password, which limits this from a pure CSRF to a credential-assisted chain. Absent that, the realistic standalone impact is account lockout, which is lower severity.

An attacker generates a PGP keypair, then crafts an HTML page containing <img src='https://target-avideo.example/path/savePublicKey.json.php?key=ATTACKER_PGP_PUBKEY'> and delivers it via a phishing email to an AVideo user who is currently logged in. When the victim's browser loads the page, it automatically issues the GET request with the victim's session cookie, replacing the stored PGP key with the attacker's. If the attacker already has the victim's account password (from a prior breach or credential stuffing), they can now log in and pass the PGP 2FA challenge, gaining full account access.