CVE-2026-84477: AVideo Stored XSS Vulnerability

CVE-2026-84477 Overview

CVE-2026-84477 is a stored Cross-Site Scripting (XSS) vulnerability in AVideo, an open-source video streaming platform maintained by WWBN. The Live_schedule::setTitle() and Live_schedule::setDescription() methods store POST input without sanitization. Users with streaming permission can inject arbitrary JavaScript payloads into live schedule records. Unauthenticated attackers can then trigger execution by directing victims to remindMe.php, which renders the stored content in the victim's browser. The flaw is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
An authenticated streamer can plant persistent JavaScript that executes in any visitor's browser session on remindMe.php, enabling session theft, credential harvesting, and account takeover of viewers and administrators.

Affected Products

WWBN AVideo (upstream repository)
AVideo Live_schedule component
AVideo remindMe.php endpoint

Discovery Timeline

2026-09-01 - CVE-2026-84477 published to the National Vulnerability Database
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84477

Vulnerability Analysis

AVideo exposes a live streaming scheduling feature backed by the Live_schedule PHP class. The setTitle() and setDescription() setter methods accept POST parameters and persist them directly to the database. Neither method applies HTML encoding, tag stripping, or contextual output escaping before storage or rendering.

When a viewer visits remindMe.php to sign up for a scheduled stream reminder, the stored title and description are emitted into the HTML response. Because the payload is echoed without escaping, any injected <script> tag or event handler executes in the viewer's browser under the AVideo origin. The vulnerability is stored, so a single injection persists until an administrator removes the record.

Root Cause

The root cause is missing input sanitization and missing output encoding across a trust boundary. The setter methods trust POST data from streaming-privileged users, and the rendering path on remindMe.php trusts database content. Neither layer applies htmlspecialchars() or an equivalent contextual escape, violating standard defense-in-depth practice for user-controlled strings.

Attack Vector

An attacker requires a low-privileged account with streaming permission to create or edit a live schedule entry. The attacker submits a crafted title or description containing JavaScript. Exploitation of the stored payload occurs when any user, including unauthenticated visitors, loads remindMe.php for that schedule. User interaction is required in the form of a page visit, but no authentication is required to trigger execution.

The vulnerability is described in prose only; no verified public exploit code is available. See the GitHub Security Advisory GHSA-625v-vrhq-g274 and the VulnCheck AVideo Stored XSS Advisory for advisory details.

Detection Methods for CVE-2026-84477

Indicators of Compromise

Live schedule records whose title or description columns contain <script, onerror=, onload=, javascript:, or encoded variants.
HTTP POST requests to live schedule creation or update endpoints containing HTML tags or JavaScript event handlers in the title or description fields.
Anomalous outbound requests from browsers after loading remindMe.php, particularly to attacker-controlled domains carrying cookies or session tokens.

Detection Strategies

Query the AVideo database for Live_schedule rows where title or description fields match XSS payload signatures.
Inspect web server access logs for remindMe.php requests followed by unexpected cross-origin requests from the same client session.
Review audit trails of accounts holding streaming permission and correlate schedule edits with subsequent XSS indicators.

Monitoring Recommendations

Deploy a Web Application Firewall rule that inspects POST bodies to live schedule endpoints for HTML and JavaScript syntax.
Enable Content Security Policy (CSP) reporting to capture inline script violations originating from remindMe.php.
Alert on privilege changes that grant streaming permission to new or dormant accounts.

How to Mitigate CVE-2026-84477

Immediate Actions Required

Apply the patched AVideo release referenced in GHSA-625v-vrhq-g274 as soon as it is available for your deployment.
Audit all existing Live_schedule records and purge or sanitize any entries containing HTML or script content.
Review and reduce the set of accounts that hold streaming permission, revoking access for unused or untrusted users.
Force password resets and invalidate active sessions for users who may have loaded remindMe.php while a malicious record was live.

Patch Information

Refer to the upstream WWBN AVideo security advisory GHSA-625v-vrhq-g274 for the fixed commit and release version. The fix must apply HTML-safe encoding in Live_schedule::setTitle() and setDescription() and enforce contextual output escaping in the remindMe.php template.

Workarounds

Restrict access to remindMe.php at the web server or reverse proxy layer until the patch is applied.
Enforce a strict Content Security Policy that disallows inline scripts and unauthorized script sources on AVideo pages.
Temporarily disable the live schedule feature or revoke streaming permission from all non-administrator accounts.
Place a WAF rule in front of AVideo that blocks POST requests to schedule endpoints containing <, >, or javascript: tokens in title or description parameters.

bash

# Example NGINX rule to block remindMe.php until patched
location = /remindMe.php {
    return 503;
}