CVE-2026-85577: AVideo Reflected XSS Vulnerability

CVE-2026-85577 Overview

CVE-2026-85577 is a reflected cross-site scripting (XSS) vulnerability in AVideo, an open-source video streaming and content management platform maintained by WWBN. The flaw resides in userLogin.php and affects the platform through commit c91b5975d. Unauthenticated attackers can inject arbitrary JavaScript by supplying a crafted error parameter that closes the surrounding </script> tag and appends attacker-controlled markup. When a victim opens the malicious link, the payload executes in their browser session on the login page. This category of flaw is tracked as CWE-79.

Critical Impact
Attackers can execute arbitrary JavaScript in a victim's browser context on the AVideo login page, enabling credential theft, session hijacking, and phishing against authenticated users.

Affected Products

WWBN AVideo through commit c91b5975d
AVideo installations exposing userLogin.php to untrusted networks
Deployments that have not applied the upstream security fix referenced in GHSA-v654-6qw8-pc33

Discovery Timeline

2026-09-04 - CVE-2026-85577 published to the National Vulnerability Database
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-85577

Vulnerability Analysis

The vulnerability is a reflected XSS in AVideo's login page handler, userLogin.php. The script reflects the error request parameter into an inline <script> block without proper contextual encoding. Because the value is echoed inside a JavaScript context, an attacker can supply a </script> sequence to prematurely terminate the script tag and follow it with arbitrary HTML or JavaScript. The browser parses the injected markup as part of the login page, and the payload runs in the victim's origin. Exploitation requires only that a user click a crafted URL, making the attack suitable for phishing campaigns targeting AVideo administrators and viewers.

Root Cause

The root cause is missing or insufficient output encoding when placing untrusted input into a JavaScript context. The application treats the error query parameter as safe HTML/JS text rather than escaping angle brackets, quotes, and the sequence </script>. HTML parsers terminate script blocks on any </script> regardless of quoting, so string-only escaping in JavaScript is not sufficient in this context. AVideo needs to encode reserved characters for both the JavaScript string literal and the surrounding HTML.

Attack Vector

An attacker crafts a URL pointing at the victim AVideo instance, for example https://<host>/userLogin.php?error=</script><script>...payload...</script>. The victim is lured to the link through email, chat, or a malicious page. On load, the AVideo server reflects the error value into the response, the browser closes the legitimate script tag, and the injected payload executes. Payloads can exfiltrate cookies where HttpOnly is not enforced, submit hidden forms to capture credentials, or pivot to CSRF against authenticated sessions. Public technical details are documented in the VulnCheck advisory for AVideo userLogin.php reflected XSS.

Detection Methods for CVE-2026-85577

Indicators of Compromise

Web server access logs containing requests to userLogin.php with an error parameter that includes </script>, <script, onerror=, or URL-encoded equivalents such as %3C%2Fscript%3E.
Referrer headers on login page requests originating from unexpected external domains or URL shorteners.
Outbound requests from browser sessions to attacker-controlled hosts immediately after a user visits userLogin.php.

Detection Strategies

Deploy a Web Application Firewall (WAF) rule that inspects query parameters on userLogin.php for script breakout sequences and HTML event handlers.
Enable a strict Content Security Policy (CSP) that reports violations to a monitored endpoint, surfacing injected inline scripts on the login page.
Correlate reflected XSS attempts against userLogin.php with subsequent authentication anomalies such as new-country logins or session-token reuse.

Monitoring Recommendations

Alert on any HTTP 200 responses to userLogin.php where the request contained decoded < or > characters in the error parameter.
Ingest AVideo web and reverse-proxy logs into a centralized analytics platform to enable retroactive hunts for exploitation URLs.
Monitor CSP violation reports for script-src blocks originating from the login page.

How to Mitigate CVE-2026-85577

Immediate Actions Required

Upgrade AVideo to a build that includes the fix referenced in GHSA-v654-6qw8-pc33; do not run builds at or before commit c91b5975d.
Deploy a WAF rule that rejects requests to userLogin.php where the error parameter contains <, >, or </script in raw or URL-encoded form.
Rotate active session cookies and invalidate persistent login tokens for accounts that may have visited attacker-supplied login URLs.

Patch Information

WWBN has published a security advisory for this issue as GHSA-v654-6qw8-pc33. Administrators should track the AVideo repository for the fixed commit and apply the update. Because AVideo is distributed as source with rolling commits rather than tagged binary releases, verify the deployed commit hash is newer than c91b5975d and includes the sanitization change for the error parameter in userLogin.php.

Workarounds

Enforce a strict Content Security Policy that disallows inline scripts on the login page, for example Content-Security-Policy: default-src 'self'; script-src 'self' (adjusted for any required first-party assets).
Set the HttpOnly and Secure flags on session cookies to limit the impact of script execution and prevent cookie theft over cleartext.
Restrict access to userLogin.php behind a reverse proxy or authenticated VPN where operationally feasible until the patched build is deployed.

bash

# Example NGINX rule to block script breakout attempts against userLogin.php
location = /userLogin.php {
    if ($arg_error ~* "(<|>|%3C|%3E|/script)") {
        return 403;
    }
    # Enforce a restrictive CSP on the login page response
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'none'" always;
    add_header X-Content-Type-Options "nosniff" always;
    proxy_pass http://avideo_backend;
}