WWBN AVideo, in versions up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1, contains a stored

Published September 10, 2026 CVE-2026-88867

WWBN AVideo can run attacker-controlled script code in an administrator's browser. The script can send requests using that administrator's active session.

Severity
HighCVSS 3.1 · 8.7
Fix
Release fix not confirmedSource revisions listed; check the advisory
Weakness
CWE-79Cross-site Scripting (XSS)
Exploit likelihood
0.32% in 30 daysEPSS, higher than 25% of known flaws
Affects
AVideo
Exploited
Not confirmedPublic proof of concept, per CISA SSVC
CISA SSVC
Proof of concept publicAutomatable: no · Technical impact: total
EU ID
EUVD-2026-75417ENISA vulnerability database

How it works

  • When enabled, an authenticated user with canUpload permission can create a video category.
  • AVideo stores the category name and icon settings, then displays them on pages for assigned videos.
  • A visitor who opens one of those pages runs the saved script, including an administrator.
  • The script can send requests using the visitor's active session.

What to do

Check the installed AVideo commit against c3edcc274c389816d434acadac07ee78eaf330c1. Verify whether usersCanCreateNewCategories is enabled and whether an authenticated user has canUpload permission. All three conditions place the installation within the affected scope.

The supplied evidence does not identify a fixed version or mitigation. Consult the WWBN AVideo advisory or the maintainer for current fix or mitigation guidance, then recheck the commit and settings.

Technical details

CVE-2026-88867 is a stored cross-site scripting flaw in AVideo category name and icon handling. It affects watch pages and Gallery cards for videos assigned to the affected category.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required Low Attacker needs a basic user account
  • User interaction Required Requires another user to take an action
  • Scope Changed Impact crosses a security authority boundary
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact None No availability impact
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N Open in FIRST.org calculator

References

View Original Source