CVE-2026-72747: AVideo Stored XSS Vulnerability

CVE-2026-72747 Overview

CVE-2026-72747 is a stored cross-site scripting (XSS) vulnerability in AVideo, an open-source video streaming platform. The flaw resides in the user registration workflow, where the phone field is stored without sanitization. Unauthenticated attackers can register accounts and inject JavaScript payloads into the phone value.

The payload persists in the database and executes when administrators load the users management page, which renders the field via innerHTML in the bootgrid component. This creates a direct path to admin session compromise from an unauthenticated position. The weakness is categorized under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
An unauthenticated attacker can hijack an administrator's browser session by registering an account containing a crafted phone value, enabling account takeover of the AVideo platform.

Affected Products

AVideo (WWBN/AVideo) open-source video streaming platform
Installations exposing public user registration
Versions prior to the commit 1adcb75458a3b31058655698a833e8cbde4d0593

Discovery Timeline

2026-08-11 - CVE-2026-72747 published to the National Vulnerability Database
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-72747

Vulnerability Analysis

AVideo's registration endpoint accepts a phone field from unauthenticated users and persists the raw value to the database. The setPhone() setter in objects/user.php performs no HTML or script tag filtering before assignment.

When an administrator opens the users management grid, the backend endpoint objects/users.json.php returns raw row data that bypasses the sanitizing User::getPhone() getter. The frontend bootgrid component then renders each field using innerHTML, which interprets any embedded HTML and executes injected <script> or event-handler payloads within the administrator's authenticated session.

Root Cause

The root cause is missing input neutralization on write combined with unsafe DOM rendering on read. The setPhone() method assigned attacker-controlled input directly, and the admin-facing JSON endpoint served the raw value, defeating any sanitization otherwise applied by the getter.

Attack Vector

Exploitation requires no prior authentication. An attacker submits the public registration form with a JavaScript payload placed inside the phone field. The payload dwells in the database until an administrator visits the users grid, at which point the script runs with administrator privileges in the browser. This enables session token theft, forced actions via the admin API, or persistence through new privileged accounts.

php

// Patch 1 — objects/user.php: sanitize on input
function setPhone($phone): void
{
-    $this->phone = $phone;
+    // Strip tags on input (consistent with setName() and getPhone()) so that
+    // unauthenticated registration cannot store HTML/JS that would later be
+    // rendered raw in the admin users grid. Prevents stored XSS (CWE-79).
+    $this->phone = strip_tags($phone);
}

Source: GitHub Commit 1adcb75

php

// Patch 2 — objects/users.json.php: defense-in-depth on output
$u = $value;
+// Defense-in-depth: the admin grid renders values via innerHTML
+// (bootgrid). $value is the raw DB row, which bypasses the sanitizing
+// User::getPhone() getter, so neutralize any stored markup here to
+// cover rows saved before setPhone() was hardened. Prevents stored XSS.
+if (isset($u['phone'])) {
+    $u['phone'] = strip_tags($u['phone']);
+}

Source: GitHub Commit 1adcb75

Detection Methods for CVE-2026-72747

Indicators of Compromise

New user records where the phone column contains HTML tags, <script>, on*= event handlers, or javascript: URIs.
Registration POST requests to the AVideo signup endpoint with phone parameter values containing angle brackets or encoded script markers such as %3Cscript%3E.
Unexpected outbound requests from administrator browsers to attacker-controlled domains immediately after accessing the users management page.
Creation of new administrator accounts or privilege changes without corresponding legitimate admin activity.

Detection Strategies

Query the users table for rows where phone REGEXP '<|>|script|onerror|onload' and quarantine matching accounts.
Inspect web server access logs for POST requests to the registration handler with payloads that fail baseline input character validation.
Deploy a web application firewall rule that flags registration submissions containing HTML metacharacters in the phone field.

Monitoring Recommendations

Log and alert on administrator sessions that issue API calls outside typical admin workflows shortly after loading the users grid.
Monitor the AVideo audit trail for privilege escalations, role changes, and new admin user creation events.
Track Content Security Policy violation reports if CSP is deployed in report-only or enforcement mode.

How to Mitigate CVE-2026-72747

Immediate Actions Required

Update AVideo to a build that includes commit 1adcb75458a3b31058655698a833e8cbde4d0593 or later.
Audit the users table and strip HTML from all existing phone values to remediate payloads stored before patching.
Rotate administrator credentials and invalidate active admin sessions if any suspect phone values are found.
Temporarily disable public user registration if immediate patching is not feasible.

Patch Information

The upstream fix is delivered in commit 1adcb75. It applies strip_tags() in both User::setPhone() (input hardening) and objects/users.json.php (output defense-in-depth for pre-existing rows). Additional context is available in the GitHub Security Advisory GHSA-cfvq-r985-84wj and the VulnCheck Stored XSS Advisory.

Workarounds

Place AVideo behind a WAF rule that blocks registration payloads containing <, >, or script keywords in the phone parameter.
Restrict access to the admin users management page to trusted network ranges via reverse proxy ACLs.
Enforce a strict Content Security Policy that disallows inline script execution in the admin interface to reduce payload viability.

bash

# Example ModSecurity rule to block script-like content in the phone field
SecRule ARGS:phone "@rx (?i)(<[^>]*script|on\w+\s*=|javascript:)" \
    "id:1072747,phase:2,deny,status:400,\
    msg:'CVE-2026-72747: Potential stored XSS payload in AVideo phone field',\
    tag:'CWE-79'"