AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability

Published September 10, 2026 CVE-2026-88869

AVideo's ad reports can run attacker-controlled code in an administrator's browser. That code can create users, change plugin settings, and rewrite site configuration.

Severity
CriticalCVSS 3.1 · 9.3
Fix
Release fix not confirmedSource revisions listed; check the advisory
Weakness
CWE-79Cross-site Scripting (XSS)
Exploit likelihood
0.48% in 30 daysEPSS, higher than 40% of known flaws
Affects
AVideo
Exploited
Not confirmedPublic proof of concept, per CISA SSVC
CISA SSVC
Proof of concept publicAutomatable: no · Technical impact: total
EU ID
EUVD-2026-75419ENISA vulnerability database

How it works

  • The enabled AD_Server plugin accepts a label from an unauthenticated tracking request.
  • It stores that label and later places it into the administrator's Ad Types report.
  • When an administrator opens the report, the stored code runs in the AVideo site.

What to do

Check the deployed AVideo revision and whether AD_Server is enabled. Compare the revision with the affected cutoff in the vendor advisory.

Review the vendor advisory for its documented fix or mitigation.

Technical details

This is stored cross-site scripting in AD_Server's label handling. The label reaches the administrator's report as webpage content, allowing JavaScript to run in the AVideo site after the report is opened.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction Required Requires another user to take an action
  • Scope Changed Impact crosses a security authority boundary
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact None No availability impact
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N Open in FIRST.org calculator

References

View Original Source