CVE-2026-88876 WWBN CVE debrief

Who should care

Defenders responsible for AVideo installations, video content security, and access control should assess exposure and implement necessary security measures. This includes verifying the security of video content, configurations, and ensuring that authorization checks are in place for getSources() calls in plugin/PlayerSkins/seo.php. Additionally, defenders should review compensating controls for exposed systems and monitor for potential security incidents.

Why it matters

The missing authorization vulnerability in AVideo's plugin/PlayerSkins/seo.php allows unauthenticated attackers to access password-protected video sources, potentially exposing sensitive content. Defenders should prioritize verifying exposure, assessing video content security, and implementing necessary authorization checks.

• Unauthenticated access to protected video sources
• Potential exposure of sensitive video content
• Need for authorization checks in plugin/PlayerSkins/seo.php
• Verification of AVideo configurations and security measures

Technical summary

The vulnerability exists in plugin/PlayerSkins/seo.php of AVideo, allowing unauthenticated attackers to access password-protected video sources by calling getSources() without password validation. This is possible because the seo.php endpoint does not properly validate passwords before providing access to video sources. As a result, attackers can request the seo.php endpoint with a video ID to obtain the direct MP4 URL and read protected media bytes. The vulnerability has a CVSS score of 8.7 and is considered HIGH severity.

Defensive priority

Defenders should prioritize verifying exposure of AVideo installations to unauthenticated access of protected video sources and assess the security of their video content.

Recommended defensive actions

• Verify AVideo installations for exposure to unauthenticated access of protected video sources
• Assess the security of video content and configurations
• Implement authorization checks for getSources() calls in plugin/PlayerSkins/seo.php
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the missing authorization vulnerability in AVideo's plugin/PlayerSkins/seo.php. The vulnerability allows unauthenticated access to password-protected video sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.