CVE-2026-85577 in AVideo
Summary
by MITRE • 09/04/2026
AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php that allows unauthenticated attackers to inject arbitrary JavaScript by closing the script tag with </script>. Attackers can craft a malicious URL with an error parameter containing script breakout sequences to execute arbitrary JavaScript in the victim's browser context on the login page.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The identified security flaw resides within AVideo, specifically affecting the userLogin.php component prior to commit c91b5975d. This vulnerability is classified as a reflected cross-site scripting (XSS) issue, which represents a significant risk to web application integrity and user data confidentiality. Reflected XSS occurs when malicious scripts are injected into legitimate-looking URLs that are then executed by the victim's browser upon loading the page. In this specific instance, the flaw allows unauthenticated attackers to inject arbitrary JavaScript code directly into the login interface of the AVideo platform. The root cause lies in insufficient input validation and sanitization mechanisms within the application logic handling user credentials or error states during the authentication process.
The technical mechanism exploited by an attacker involves crafting a malicious URL that targets the error parameter associated with the login functionality. By embedding script breakout sequences, such as closing tags like </script>, into this parameter, the attacker can break out of any existing HTML context and inject new executable JavaScript code. When a victim clicks on or is redirected to this crafted link while attempting to log in, their browser parses the injected payload alongside the legitimate page content. Because the script executes within the same origin as the application, it inherits all privileges associated with that domain, including access to cookies, session tokens, and potentially sensitive user data stored locally by the web application.
The operational impact of this vulnerability is severe due to its potential for widespread exploitation without requiring prior authentication. An attacker can distribute malicious links through phishing emails, social media posts, or other vectors where users are likely to interact with the AVideo login page. Successful execution allows the attacker to perform actions on behalf of the victim, such as stealing session cookies to hijack active sessions, redirecting users to phishing sites designed to capture credentials, or defacing the application interface. This undermines trust in the platform and can lead to unauthorized access to user accounts and associated video content management capabilities.
From a classification perspective, this vulnerability aligns with CWE-79: Improper Neutralization of Input During Web Page Generation, commonly known as Cross-site Scripting (XSS). It also maps to MITRE ATT&CK technique T1059.007: JavaScript, which describes the use of client-side scripting languages for execution within a browser environment. The lack of proper encoding or validation of user-supplied input in dynamic web content generation is the primary driver of this weakness.
To mitigate this vulnerability, developers must implement strict input validation and output encoding strategies. All data received from users, particularly parameters used in HTML contexts like error messages displayed on login pages, should be validated against a whitelist of expected characters or formats where possible. Furthermore, all dynamic content rendered to the browser must undergo proper context-aware encoding, such as HTML entity encoding for text nodes or JavaScript escaping for script blocks. Implementing Content Security Policy (CSP) headers can also provide an additional layer of defense by restricting the sources from which scripts are allowed to execute, thereby limiting the impact even if a successful injection occurs. Upgrading to versions of AVideo that include commit c91b5975d or later is recommended as it addresses these specific input handling deficiencies in userLogin.php.