CVE-2026-88866
HighCVSS 8.7Summary
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LoginControl plugin that fails to encode the User-Agent header before storing it in login history. Attackers with any valid login account can inject malicious scripts in the User-Agent header that execute in administrator browsers when viewing the Login History page.
Risk Assessment
Malicious scripts execute in the administrator session when viewing the login history, potentially leading to administrative account takeover. This poses a serious threat to the security of the entire installation.
Recommendation
Encode the User-Agent header before storing it in login history. Until a patch is available, consider restricting access to the login history page.
Other vulnerabilities in AVideo
See all- CVE-2026-88876High
AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in plugin/PlayerSkins/seo.php. Unauthenticated attackers can access password-protected video sources by calling getSources() without password validation and obtain the direct MP4 URL.
- CVE-2026-88875Medium
AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) incompletely sanitizes sensitive user fields in the APIName=video response. Video rows include columns joined from the video owner's user record, and API::get_api_video() calls removeSensitiveUserFields() only when the caller is neither authenticated nor using a valid API secret; it never compares User::getId() with the row's users_id. As a result, any low-privilege authenticated account can request another user's video and receive the owner's email address, account name (user), and isAdmin, canUpload, and canStream flags.
- CVE-2026-88874High
AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 does not enforce the Live stream password check on the stats endpoint or on the HLS origin. Live::_getStats() returns a password-protected transmission's RTMP stream key, isPasswordProtected flag, and HLS URL to unauthenticated callers, and the shipped NGINX configuration serves the .m3u8 playlist, AES-128 key, and transport-stream segments without authentication.
- CVE-2026-88873High
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in view/logArchive.json.php. Unauthenticated attackers can archive application logs via GET requests without CSRF token validation, copying sensitive logs to a publicly accessible zip file and truncating the live log.
- CVE-2026-88872High
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in the setPassword.json.php endpoint. Unauthenticated attackers can modify any user's channel password by sending a GET request without CSRF token validation.
- CVE-2026-88871Medium
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) contains a cross-site request forgery vulnerability in the CustomizeUser plugin's plugin/CustomizeUser/setSubscribers.json.php endpoint. The script reads users_id and ExtraSubscribers from $_REQUEST and calls User::setExtraSubscribers() without requiring a POST request or a valid CSRF token; autoCSRFGuard() is applied only to POST requests to *.json.php, and the mutation does not pass through ObjectYPT::save()/isUntrustedRequest(), so a cross-origin GET succeeds. An unauthenticated remote attacker who induces a logged-in administrator to load a crafted page (e.g., an <img> tag pointing at the endpoint) can forge the ExtraSubscribers count displayed on any user's channel.
- CVE-2026-88870High
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in the LoginControl plugin PGP key endpoints that lack CSRF token validation. Attackers can craft malicious pages with image tags pointing to savePublicKey.json.php to replace a logged-in victim's PGP 2FA public key.
- CVE-2026-88868High
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LiveLinks plugin where title and description fields are stored without sanitization. A user with canStream permission can inject malicious scripts that execute in the browser of every visitor viewing the live-link page, including administrators.
- CVE-2026-88867High
WWBN AVideo in versions up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability. objects/categoryAddNew.json.php passes the POST parameters name and iconClass to Category::setName() and Category::setIconClass(), which store the values without sanitization, and they are later echoed as HTML in views and gallery cards.
- CVE-2026-88865High
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate restream ownership in getRestream.json.php, allowing authenticated users with canStream permission to mint tokens for arbitrary restreams. Attackers can exchange the token to retrieve other users' stream keys from getLiveKey.json.php and publish to their YouTube, Twitch, or RTMP destinations.
Original NVD description (English source)
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LoginControl plugin that fails to encode the User-Agent header before storing it in login history. Attackers with any valid login account can inject malicious scripts in the User-Agent header that execute in administrator browsers when viewing the Login History page, allowing script execution within the administrator session.