CVE-2026-88871 WWBN AVideo CustomizeUser setSubscribers CSRF via GET
An attacker can trick a logged-in administrator into modifying subscriber counts via a crafted GET request in the AVideo CustomizeUser plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-88871?
CVE-2026-88871 is a medium-severity vulnerability in WWBN AVideo, published on 10 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) contains a cross-site request forgery vulnerability in the CustomizeUser plugin's plugin/CustomizeUser/setSubscribers.json.php endpoint. The script reads users_id and ExtraSubscribers from $_REQUEST and calls User::setExtraSubscribers() without requiring a POST request or a valid CSRF token; autoCSRFGuard() is applied only to POST requests to *.json.php, and the mutation does not pass through ObjectYPT::save()/isUntrustedRequest(), so a cross-origin GET succeeds. An unauthenticated remote attacker who induces a logged-in administrator to load a crafted page (for example an <img> tag pointing at the endpoint) can forge the ExtraSubscribers count displayed on any user's channel. The CustomizeUser plugin is enabled by default, and no patched version was available at the time of reporting.
Weakness: CWE-352
Which versions are affected by CVE-2026-88871?
How do I fix CVE-2026-88871?
No fix has been published for CVE-2026-88871 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-88871 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-88871 exists.
Sources
Also known as GHSA-277g-79xq-9cwq, GHSA-p9c3-prq7-g8xc.