AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability

Published September 10, 2026 CVE-2026-88868

AVideo can run attacker-controlled scripts in browsers viewing an affected live-link page, including administrators. Those scripts can use the visitor's AVideo access to fetch administrative endpoints with their cookies.

Severity
HighCVSS 3.1 · 8.7
Fix
Release fix not confirmedSource revisions listed; check the advisory
Weakness
CWE-79Cross-site Scripting (XSS)
Exploit likelihood
0.26% in 30 daysEPSS, higher than 17% of known flaws
Affects
AVideo
Exploited
Not confirmedNo confirmation recorded
CISA SSVC
No known exploitationAutomatable: no · Technical impact: partial
EU ID
EUVD-2026-75418ENISA vulnerability database

How it works

  • A user with canStream permission can save script content in a live-link title or description.
  • AVideo stores those fields without safely removing the script, then places them into the live-link page.
  • Visitors who open that page run the script inside the AVideo site.

What to do

Check the deployed AVideo revision against commit c3edcc274c389816d434acadac07ee78eaf330c1. Also confirm whether LiveLinks is enabled and onlyAdminCanAddLinks is set to false.

Follow the AVideo security advisory for any published fix or mitigation.

Technical details

This is stored cross-site scripting in AVideo's LiveLinks plugin. The title and description are inserted into the public Live.php page without HTML filtering, allowing scripts to run in the AVideo site origin.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required Low Attacker needs a basic user account
  • User interaction Required Requires another user to take an action
  • Scope Changed Impact crosses a security authority boundary
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact None No availability impact
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N Open in FIRST.org calculator

References

View Original Source