AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability

Published September 11, 2026 CVE-2026-89255

A logged-in AVideo user can save harmful code as a public encryption key. The code runs in an administrator's session when they open that user's profile.

Severity
HighCVSS 3.1 · 8.7 · vulncheck.com
Fix
Release fix not confirmedSource revisions listed; check the advisory
Weakness
CWE-79Cross-site Scripting (XSS)
Affects
AVideo
Exploited
Not confirmedPublic proof of concept, per CISA SSVC
CISA SSVC
Proof of concept publicAutomatable: no · Technical impact: total
EU ID
EUVD-2026-76067ENISA vulnerability database

How it works

  • The LoginControl feature must be enabled, and the attacker needs an account.
  • The attacker submits harmful code as a public encryption key.
  • AVideo saves the text without making it safe for display.
  • When an administrator opens that user's profile, AVideo places the saved text into the page.
  • The browser then runs the code using the administrator's session.

What to do

If you administer AVideo with LoginControl enabled, compare the deployed commit with c3edcc274c389816d434acadac07ee78eaf330c1. Treat that commit and earlier commits as affected. Ask your host or application maintainer to confirm the comparison if needed.

Follow the AVideo advisory for a documented fix or mitigation. It listed no fixed version at reporting.

Technical details

LoginControl stores a user-controlled PGP public key and later places it unencoded inside an administrator page's textarea. Closing that page element lets embedded JavaScript run in the administrator's session. Exploitation requires LoginControl, a logged-in attacker, and an administrator opening the attacker's profile tab.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required Low Attacker needs a basic user account
  • User interaction Required Requires another user to take an action
  • Scope Changed Impact crosses a security authority boundary
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact None No availability impact
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N Open in FIRST.org calculator

References

View Original Source