CVE-2026-89239: WWBN AVideo Reflected XSS Vulnerability

CVE-2026-89239 Overview

CVE-2026-89239 is a reflected cross-site scripting (XSS) vulnerability in WWBN AVideo, an open-source video streaming platform. The flaw exists in the showAlertMessage() function, which inserts the raw HTTP Referer header into a JavaScript comment without proper encoding. Attackers can craft a Referer header containing */ to close the comment context and inject arbitrary JavaScript. The injected script executes in the site origin for any visitor arriving from an attacker-controlled page. The vulnerability affects WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 and is classified under [CWE-79].

Critical Impact
Attackers can execute arbitrary JavaScript in a victim's browser session on the AVideo origin, enabling session theft, credential harvesting, and unauthorized actions on behalf of the user.

Affected Products

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1
AVideo installations exposing the showAlertMessage() code path
Self-hosted AVideo streaming deployments prior to the patched revision

Discovery Timeline

2026-09-11 - CVE CVE-2026-89239 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-89239

Vulnerability Analysis

The vulnerability resides in the client-side showAlertMessage() function within WWBN AVideo. The function embeds the incoming HTTP Referer header value directly inside a JavaScript block comment (/* ... */) without applying output encoding or sanitization. Because the header is treated as trusted string data, an attacker who controls the referring page can inject a payload containing the sequence */ to terminate the comment prematurely. Any JavaScript that follows executes with full privileges of the AVideo origin. Exploitation is reflected: the payload must be delivered per-request via the victim's browser navigation from an attacker-controlled page.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The showAlertMessage() function violates the principle that untrusted data should never be placed into a script context without contextual encoding. JavaScript comment contexts require escaping or removal of the */ sequence to prevent comment breakout. AVideo instead concatenates the raw Referer header directly into JavaScript source, allowing an attacker to escape the intended string context.

Attack Vector

Exploitation requires user interaction: a victim must click a link on an attacker-controlled page that navigates to a vulnerable AVideo endpoint invoking showAlertMessage(). The attacker hosts a page that sets a crafted Referer header containing the comment-breakout sequence followed by JavaScript. When the victim's browser sends the request, AVideo reflects the header into script context and the payload executes. The attack does not require authentication and works over the network.

No public proof-of-concept code is available. See the GitHub Security Advisory GHSA-3pp9-g99w-qw3j and the VulnCheck Reflected XSS Advisory for additional technical detail.

Detection Methods for CVE-2026-89239

Indicators of Compromise

HTTP requests to AVideo endpoints containing Referer headers with the substring */ followed by JavaScript syntax such as <script>, alert(, document.cookie, or fetch(.
Web server access logs showing unusually long or encoded Referer header values referencing untrusted external domains.
Browser console errors or unexpected outbound requests from AVideo pages to attacker-controlled domains.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the Referer header for JavaScript comment-breakout patterns and script tags.
Monitor for anomalous session activity following user navigation from external referrers, including token reuse from unexpected IP addresses.
Review AVideo application logs for requests to pages invoking showAlertMessage() with malformed referrer values.

Monitoring Recommendations

Enable and forward HTTP request logs including full Referer header contents to a centralized log platform for retrospective hunting.
Alert on Content Security Policy (CSP) violation reports originating from AVideo hosts, which can indicate injected script execution.
Track outbound network traffic from browsers of authenticated AVideo users for connections to unfamiliar domains shortly after page loads.

How to Mitigate CVE-2026-89239

Immediate Actions Required

Upgrade WWBN AVideo to a revision beyond commit c3edcc274c389816d434acadac07ee78eaf330c1 that includes the fix for showAlertMessage().
Apply a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Configure upstream proxies or WAF rules to strip or normalize Referer headers containing comment-breakout sequences.

Patch Information

Refer to the GitHub Security Advisory GHSA-3pp9-g99w-qw3j for the vendor patch and remediated commit range. The fix encodes or sanitizes the Referer header value before it is embedded in JavaScript context, preventing comment breakout. Administrators should pull the latest AVideo revision from the upstream repository and redeploy.

Workarounds

Deploy WAF signatures that block requests where the Referer header contains */ combined with JavaScript keywords such as <script, onerror=, or javascript:.
Set the Referrer-Policy response header on sensitive pages to reduce referrer exposure and limit attacker control over referrer content.
Restrict access to AVideo administrative endpoints via IP allowlisting until the patched version is deployed.

bash

# Example nginx configuration to strip suspicious Referer headers
map $http_referer $safe_referer {
    default              $http_referer;
    "~\*/"               "";
    "~<script"           "";
    "~javascript:"       "";
}

server {
    listen 443 ssl;
    server_name avideo.example.com;

    proxy_set_header Referer $safe_referer;
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'";
    add_header Referrer-Policy "strict-origin-when-cross-origin";

    location / {
        proxy_pass http://avideo_backend;
    }
}