CVE-2026-88870

Name of the Vulnerable Software and Affected Versions WWBN AVideo versions prior to commit c3edcc274c389816d434acadac07ee78eaf330c1

Description A cross-site request forgery (CSRF) issue exists in the LoginControl plugin. The PGP key endpoints do not validate CSRF tokens, allowing attackers to use malicious pages with image tags targeting the 'savePublicKey.json.php' endpoint. This can be used to replace the PGP 2FA public key of an authenticated user, potentially leading to account lockout or account takeover if the attacker possesses the user's password.

Recommendations Update WWBN AVideo to the version containing commit c3edcc274c389816d434acadac07ee78eaf330c1.