WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting

Published September 11, 2026 CVE-2026-89253

A logged-in AVideo user can hide browser code in their profile's donation link. It runs when visitors, including administrators, watch their video and interact with the button.

Severity
HighCVSS 3.1 · 8.7 · vulncheck.com
Fix
Release fix not confirmedSource revisions listed; check the advisory
Weakness
CWE-79Cross-site Scripting (XSS)
Affects
AVideo
Exploited
Not confirmedPublic proof of concept, per CISA SSVC
CISA SSVC
Proof of concept publicAutomatable: no · Technical impact: total
EU ID
EUVD-2026-76065ENISA vulnerability database

How it works

  • A logged-in AVideo user saves a specially crafted donation address in their profile.
  • AVideo accepts quote characters inside that address and stores the value.
  • When donation links are enabled, each video page places it inside a button.
  • The quote escapes the button's web address and adds attacker-controlled browser code.
  • That code runs after a visitor views the video and interacts with the button.

What to do

If you administer AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 or earlier, check whether donation links are enabled. Compare your deployed commit with the advisory's affected cutoff.

Review the GitHub advisory for a documented fix or mitigation. It listed no patched version when reported. Watch the same advisory for a patched version before treating an update as resolving this flaw.

Technical details

The stored cross-site scripting flaw affects the donationLink profile field. URL validation accepts embedded quotation marks, while the watch page inserts the stored value into an HTML link without safely encoding them. Exploitation requires an account, an affected AVideo commit, and the allowDonationLink option. A visitor must view the attacker's video and interact with its donation button.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required Low Attacker needs a basic user account
  • User interaction Required Requires another user to take an action
  • Scope Changed Impact crosses a security authority boundary
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact None No availability impact
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N Open in FIRST.org calculator

References

View Original Source