CVE-2026-89255 in AVideo
Summary
by MITRE • 09/11/2026
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LoginControl plugin that fails to HTML-encode PGP public keys echoed into a textarea element. An authenticated attacker can inject malicious JavaScript by submitting a crafted public key, which executes in an administrator's session when viewing the user's profile tab.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/11/2026
The identified vulnerability resides within the AVideo platform, specifically affecting the LoginControl plugin prior to commit c3edcc274c389816d434acadac07ee78eaf330c1. This security flaw is classified as a stored cross-site scripting issue that stems from an insufficient input validation and output encoding mechanism. The core technical failure occurs when the application processes PGP public keys submitted by users during authentication or profile configuration workflows. Instead of properly sanitizing these inputs, the system directly echoes the raw content of the PGP key into a textarea element on the user's profile page without applying necessary HTML entity encoding. This lack of proper context-aware output encoding allows special characters and script tags to be interpreted as executable code by the browser rather than being rendered as plain text data.
From an operational perspective, this vulnerability enables authenticated attackers to execute arbitrary JavaScript in the context of other users' sessions, particularly targeting administrators who view the profiles of maliciously crafted accounts. The attack vector requires initial authentication, meaning the attacker must first compromise or create a valid user account within the AVideo system. Once authenticated, the adversary submits a specially constructed PGP public key containing embedded script payloads. When an administrator navigates to the profile tab of this compromised account, the browser parses the unencoded content and executes the injected JavaScript code. This execution occurs with the privileges of the viewing administrator, effectively bypassing same-origin policy protections that typically isolate web applications from malicious scripts.
The impact of such a stored cross-site scripting vulnerability is severe because it persists on the server side until remediated. Unlike reflected XSS which requires tricking a user into clicking a link, this attack vector remains active in the database and triggers automatically upon profile viewing. An attacker can leverage this capability to steal session cookies, perform actions as the administrator such as modifying system configurations or deleting content, keylogging within the application interface, or redirecting users to phishing sites. The persistence of the payload means that every subsequent view by an authorized user potentially results in a security breach, amplifying the blast radius significantly compared to transient vulnerabilities.
This flaw aligns with Common Weakness Enumeration identifier CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. Specifically, it represents a case where input validation is present but output encoding in the specific HTML context (a textarea element) is neglected. In terms of offensive security frameworks, this vulnerability facilitates techniques associated with MITRE ATT&CK T1059 Command and Scripting Interpreter through browser-based execution, allowing for further lateral movement or privilege escalation within the application environment. The failure to encode data destined for a text area suggests a broader systemic issue in how user-generated content is handled throughout the AVideo codebase, potentially exposing other features to similar exploitation vectors if they follow the same pattern of direct echoing without sanitization.
Mitigation strategies must focus on implementing robust output encoding practices consistent with OWASP guidelines. Developers should ensure that all dynamic data inserted into HTML contexts undergoes appropriate escaping based on where it is placed; for text areas, this typically involves converting special characters like ampersands, less-than signs, greater-than signs, and quotes into their corresponding HTML entities before rendering. Additionally, implementing a Content Security Policy can provide an additional layer of defense by restricting the sources from which scripts are allowed to load or execute, thereby mitigating the impact even if XSS is successfully injected. Regular security code reviews focusing on input validation and output encoding across all plugins, particularly those handling cryptographic keys or user profiles, will help prevent recurrence. Updating to a version of AVideo that includes commit c3edcc274c389816d434acadac07ee78eaf330c1 is the primary remediation step for existing deployments.