Cross-Site Request Forgery Vulnerability in WWBN AVideo CustomizeUser Plugin

CVE-2026-88871

What is CVE-2026-88871?

The CustomizeUser plugin for WWBN AVideo contains a CSRF vulnerability that allows an unauthenticated attacker to manipulate user data. By exploiting the plugin's setSubscribers endpoint, an attacker can craft a page that triggers an action leading to altered subscriber counts for any user's channel. The attack takes place when a logged-in administrator unknowingly accesses a malicious page, thereby bypassing verification processes meant to enforce security. This vulnerability arose due to improper validation of requests where POST methods and CSRF tokens are overlooked, potentially compromising user data integrity.

References