CVE-2026-100630: AVideo Stored XSS Vulnerability

CVE-2026-100630 Overview

CVE-2026-100630 is a stored cross-site scripting (XSS) vulnerability in AVideo, an open-source video streaming platform maintained by WWBN. The flaw resides in the handling of the trailer1 video field, which is rendered unsanitized inside an inline onclick JavaScript string. Attackers with video upload permissions can submit HTML entity-encoded payloads that bypass the isValidURL() validation routine. When a visitor loads the affected page, the browser decodes the entities and breaks out of the JavaScript string context, executing attacker-controlled code in the visitor's session. The weakness is tracked as CWE-79.

Critical Impact

Authenticated uploaders can hijack sessions of any visitor who views the malicious video, including administrators, enabling account takeover and privilege escalation.

Affected Products

• WWBN AVideo (open-source video streaming platform)
• Installations exposing the video upload workflow to non-administrative users
• Deployments rendering the trailer1 field in player or listing views

Discovery Timeline

• 2026-09-26 - CVE-2026-100630 published to the National Vulnerability Database
• 2026-09-30 - Entry last modified in NVD

Technical Details for CVE-2026-100630

Vulnerability Analysis

AVideo stores the trailer1 value supplied during video creation and later emits it directly into an inline onclick attribute. The server-side isValidURL() check inspects the raw input and rejects obvious script content, but it does not account for HTML entity encoding. An attacker submits a payload where characters such as quotes and angle brackets are expressed as HTML entities (for example " or '). The validator sees a benign string and persists it. When the page renders, the browser's HTML parser decodes the entities before the JavaScript parser evaluates the onclick handler. The attacker-supplied content escapes the JavaScript string literal and executes arbitrary script in the victim's browser context.

Root Cause

The root cause is a context mismatch between validation and output. isValidURL() validates in a text context, while the value is consumed in a nested HTML-then-JavaScript context. AVideo neither re-encodes the value for JavaScript string embedding nor rejects HTML entity sequences at ingestion, violating the output-encoding guidance in CWE-79.

Attack Vector

Exploitation requires an authenticated account with video upload rights and victim interaction with the malicious video page. The attacker uploads a video and sets the trailer1 field to an HTML entity-encoded payload that terminates the enclosing JavaScript string and appends arbitrary code. When any user, including an administrator, views the video detail page and interacts with the element bound to the onclick handler, the payload executes with full access to the victim's session cookies, CSRF tokens, and the AVideo administrative interface. Because the payload is stored server-side, every subsequent visitor to the page is affected until the record is purged.

Refer to the VulnCheck Stored XSS Advisory and the GitHub Security Advisory for payload specifics.

Detection Methods for CVE-2026-100630

Indicators of Compromise

• Video records whose trailer1 column contains HTML entities such as ", ', <, or > combined with JavaScript keywords (onerror, alert, fetch, document.cookie).
• Outbound requests from administrator browsers to unexpected domains shortly after visiting a video page.
• New administrative accounts, role changes, or API tokens created without a corresponding console login event.

Detection Strategies

• Query the AVideo database for trailer1 values containing &#, ", <, or javascript: substrings.
• Deploy a Content Security Policy (CSP) in report-only mode and alert on script-src violations originating from the video player route.
• Review web server access logs for POST requests to the video create or edit endpoints that include URL-encoded entity payloads.

Monitoring Recommendations

• Correlate uploader account activity with downstream administrator session anomalies such as new IP addresses or privileged configuration changes.
• Monitor browser-side JavaScript error telemetry on the video detail page for parse errors that indicate attempted string break-outs.
• Alert on changes to privileged user records or site settings that occur immediately after an administrator views a user-uploaded video.

How to Mitigate CVE-2026-100630

Immediate Actions Required

• Upgrade AVideo to the patched release referenced in the GitHub Security Advisory GHSA-v7vx-v9q9-qhw3.
• Restrict video upload permissions to trusted users until the patch is deployed.
• Audit the videos table for trailer1 values containing HTML entities or script fragments and purge or sanitize offending records.

Patch Information

WWBN has published fix guidance in the project's GitHub Security Advisory. The remediation enforces proper encoding of the trailer1 field for JavaScript string contexts and rejects HTML entity-encoded payloads at the validation layer. Administrators should apply the vendor-supplied update and re-test the video upload workflow after deployment.

Workarounds

• Temporarily disable the trailer1 field in the upload form, or strip the attribute server-side before rendering.
• Deploy a strict Content Security Policy that forbids inline event handlers (script-src 'self'; script-src-attr 'none') to neutralize the inline onclick sink.
• Place a web application firewall rule in front of AVideo that blocks POST bodies to video endpoints containing HTML entity sequences adjacent to JavaScript keywords.

# Example CSP header to block inline event handlers
Content-Security-Policy: default-src 'self'; script-src 'self'; script-src-attr 'none'; object-src 'none'; base-uri 'self'