WWBN AVideo CVE-2026-88871

The victim must be a logged-in AVideo administrator or a user with sufficient privileges to have their session recognized by the setSubscribers.json.php endpoint. The CustomizeUser plugin must be active - it is enabled by default in AVideo, so no special administrator action is required to create the vulnerable condition. The attacker must successfully deliver a page containing the crafted GET request to the victim (requires social engineering; user interaction classified as UI:P in CVSS 4.0). No authentication, API key, or elevated network position is required on the attacker's side. The limiting factor is the social engineering step: the attack cannot be fully automated without convincing the administrator to load attacker-controlled content. Deployments behind a reverse proxy that strips or rewrites GET parameters to this endpoint path, or that enforce SameSite cookie policies, are partially mitigated.

The CVSS 4.0 score of 5.3 with UI:P (victim interaction required) and VI:L (low integrity impact) accurately reflects the constrained real-world risk. The attacker must induce an authenticated administrator to visit a controlled page - a social engineering prerequisite that limits automatable exploitation. The impact is narrow: only the ExtraSubscribers display count for a channel can be manipulated, with no confidentiality or availability consequence. There is no CISA KEV listing and no identified POC exploit code beyond the advisory disclosure. EPSS data is absent from the provided intelligence. The CustomizeUser plugin being enabled by default broadens the attack surface across all AVideo deployments, but the impact ceiling (cosmetic subscriber count tampering) keeps operational priority moderate. The absence of a patch at reporting time is a material risk factor for defenders who cannot simply upgrade. No conflicting signals between CVSS vector and description - the GET-based CSRF mechanism is consistent with AV:N/PR:N/UI:P.

An attacker registers or identifies a target AVideo user channel and crafts a public webpage containing an HTML tag such as <img src='https://target-avideo.example.com/plugin/CustomizeUser/setSubscribers.json.php?users_id=42&ExtraSubscribers=9999999'> then socially engineers an AVideo administrator into visiting that page (e.g., via phishing email or poisoned forum post). The administrator's browser automatically issues the GET request with their active session cookie, causing the AVideo server to call User::setExtraSubscribers() and set the display subscriber count to the attacker-chosen value for the targeted channel without any CSRF validation.