WWBN AVideo contains a CSRF vulnerability in the LoginControl plugin's PGP key endpoints, specifically in savePublicKey.json.php, which do not validate CSRF tokens. An attacker can exploit this by embedding malicious image tags in web pages that trigger requests to replace a logged-in victim's PGP 2FA public key. This manipulation can cause the victim to be locked out or enable account takeover if the attacker also knows the victim's password. The vulnerability is identified in commit c3edcc274c389816d434acadac07ee78eaf330c1. No official patch or remediation level has been published yet.

An attacker can force a logged-in user to unknowingly replace their PGP 2FA public key, potentially locking the user out of their account or allowing the attacker to take over the account if the attacker knows the user's password. This compromises the integrity of the two-factor authentication mechanism and can lead to unauthorized access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users and administrators should be cautious about visiting untrusted websites while logged in and consider disabling the vulnerable plugin or functionality if possible.