CVE-2026-85159 in AVideo
Summary
by MITRE • 09/03/2026
AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php where the cancelUri parameter is echoed in an href attribute after isSafeRedirectURL checks protocol only, not HTML characters. Unauthenticated attackers can inject event handlers via relative URLs with embedded quotes to execute arbitrary JavaScript when users interact with the Cancel button.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/03/2026
The identified vulnerability resides within the AVideo web application platform and specifically affects the userLogin.php module prior to commit c91b5975d. This flaw is classified as a reflected cross-site scripting (XSS) issue, which stems from insufficient input validation and sanitization of the cancelUri parameter. The core technical deficiency lies in the implementation of the isSafeRedirectURL function, which serves as the primary security control for this specific code path. While this function correctly validates that the redirect URL utilizes a safe protocol such as HTTP or HTTPS to prevent open redirection attacks via external domains, it fails to perform any checks against HTML special characters within the query string or fragment components of the URI. Consequently, when an attacker crafts a maliciously constructed relative URL containing embedded quotes and JavaScript event handlers, these payloads are passed through the validation logic unchecked because they do not violate the protocol restriction.
Upon successful exploitation, the application echoes the unsanitized cancelUri parameter directly into an HTML href attribute without proper encoding or escaping. This allows unauthenticated attackers to inject arbitrary client-side scripts that execute in the context of the victim's browser session when a user interacts with the Cancel button on the login interface. The reflected nature of this vulnerability means that exploitation typically requires social engineering, where the attacker must lure a target into clicking a specially crafted link or submitting a form containing the malicious payload. Once triggered, the injected JavaScript runs within the domain of the AVideo instance, granting the attacker significant capabilities to manipulate the user experience, steal session cookies, capture authentication credentials entered on subsequent pages, or perform actions on behalf of the authenticated user if they are logged in at the time of interaction.
From a threat modeling perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific vector involves reflected input via URL parameters, placing it firmly within the OWASP Top Ten category for injection flaws that lead to client-side code execution. In terms of adversary tactics, this aligns with MITRE ATT&CK technique T1059, Command and Scripting Interpreter, specifically through JavaScript interpretation in a web browser context. The lack of output encoding allows the attacker to bypass standard security controls by exploiting the ambiguity between URL parsing and HTML attribute parsing, demonstrating how partial validation can create significant security gaps even when some aspects of input are checked for safety.
To mitigate this vulnerability, developers must implement comprehensive input sanitization that goes beyond protocol verification. It is essential to apply strict output encoding appropriate for the context in which data is rendered; since the cancelUri value is placed within an HTML attribute, it requires HTML entity encoding or JavaScript string escaping before being inserted into the DOM. Additionally, implementing a Content Security Policy (CSP) can provide a robust defense-in-depth layer by restricting the sources from which scripts are allowed to execute, thereby neutralizing the impact of any successfully injected payloads even if input validation is bypassed. Upgrading to versions of AVideo that include commit c91b5975d or later resolves this issue as it presumably addresses these encoding deficiencies and ensures that all dynamic content is properly sanitized before rendering in the browser environment.