The flaw lives in the LoginControl plugin of WWBN AVideo. The plugin’s PGP key endpoints lack CSRF token validation, permitting an attacker to construct a malicious page that includes an image tag pointing to savePublicKey.json.php. When an authenticated user visits the page, the endpoint processes the request and replaces the user’s PGP 2FA public key. The result is either a forced lockout of the account or, if the attacker also knows the user’s password, a full takeover of the account. This is a classic CSRF weakness categorized as CWE‑352.

The vulnerability affects all instances of WWBN AVideo that include the LoginControl plugin prior to the commit that introduced CSRF protection. The affected package is identified by the vendor WWBN and product AVideo; no specific version numbers are supplied but any installation that contains the vulnerable code from commit c3edcc274c389816d434acadac07ee78eaf330c1 is at risk.

The CVSS score is 7.1, indicating a substantial impact if exploited. Because the flaw is a CSRF attack, it requires the victim to be authenticated to the site and to visit a crafted page. There is no EPSS score available, and the vulnerability is not listed in the CISA KEV catalog, but the exposure remains real for exposed installations. Attackers can exploit the endpoint simply by embedding an image tag in any page visited by the target, making the risk moderate to high for organizations that allow untrusted content to be viewed by logged‑in users.