CVE-2026-89240: WWBN AVideo Reflected XSS Vulnerability

CVE-2026-89240 Overview

CVE-2026-89240 is a reflected cross-site scripting (XSS) vulnerability in WWBN AVideo, an open-source video streaming platform. The flaw exists in plugin/Live/confirmLivePassword.php, which interpolates the unauthenticated GET parameter u directly into an <img src="..."> attribute without URL or HTML encoding. The parameter is not covered by $securityFilter, allowing attackers to break out of the attribute and inject arbitrary HTML. The vulnerability affects AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1, and no patched version was available at the time of the advisory. The issue is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
A remote attacker can execute arbitrary JavaScript in the browser of any user, including administrators, who clicks a crafted link, enabling session hijacking or account takeover.

Affected Products

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1
AVideo Live plugin (plugin/Live/confirmLivePassword.php)
All deployments running unpatched builds at the time of the advisory

Discovery Timeline

2026-09-11 - CVE-2026-89240 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-89240

Vulnerability Analysis

The vulnerability resides in the confirmLivePassword.php script within the AVideo Live plugin. The script accepts a GET parameter named u and reflects it into the HTML response inside the src attribute of an <img> tag. Because the value passes through neither URL encoding nor HTML encoding, an attacker who supplies a double-quote character can terminate the attribute early. Subsequent injected markup, such as a rogue tag with an onerror handler, executes in the origin of the AVideo site.

Exploitation requires user interaction. The victim must open an attacker-supplied link that includes a crafted u value, a non-empty key parameter, and no valid c parameter. Once triggered, the injected JavaScript runs with the privileges of the current browser session, which may include an authenticated administrator.

Root Cause

The root cause is missing output encoding on an unauthenticated request parameter. The application's central $securityFilter mechanism does not include the u parameter, so untrusted input reaches the HTML sink unsanitized. This is a textbook reflected XSS pattern where server-side templating concatenates raw user input into an HTML attribute context.

Attack Vector

Exploitation is network-based and requires no authentication. The attacker crafts a URL to the vulnerable endpoint containing a payload in u that closes the src attribute and introduces an event handler. The victim clicks the link, typically delivered by phishing or embedded in another site, and the malicious JavaScript executes in the AVideo origin. Impact includes theft of session cookies, forced actions via the administrative interface, and defacement of rendered content.

Refer to the GitHub Security Advisory GHSA-87qx-9wgx-954f and the VulnCheck Advisory on Reflected XSS for the payload structure and reproduction steps.

Detection Methods for CVE-2026-89240

Indicators of Compromise

HTTP GET requests to /plugin/Live/confirmLivePassword.php containing a double-quote character or URL-encoded %22 within the u parameter.
Requests to the same endpoint that include a key parameter but omit a valid c parameter.
Response bodies from confirmLivePassword.php containing injected onerror, onload, or <script> markup.

Detection Strategies

Inspect web server access logs for query strings targeting confirmLivePassword.php with suspicious characters such as ", <, >, or event handler keywords.
Deploy web application firewall (WAF) rules that flag reflected XSS payloads in the u parameter of the Live plugin endpoint.
Correlate outbound requests from browsers immediately following visits to the vulnerable endpoint, which may indicate cookie exfiltration.

Monitoring Recommendations

Enable HTTP request and response logging for all AVideo plugin endpoints, retaining full query strings.
Monitor administrator accounts for anomalous session activity, unexpected API calls, or password resets shortly after link clicks.
Alert on Content Security Policy (CSP) violation reports originating from the AVideo domain.

How to Mitigate CVE-2026-89240

Immediate Actions Required

Restrict public access to /plugin/Live/confirmLivePassword.php at the reverse proxy or WAF layer until a vendor patch is available.
Instruct administrators to avoid clicking untrusted links referencing the AVideo host, especially those containing confirmLivePassword.php.
Rotate administrator session tokens and credentials if suspicious access to the endpoint has been observed.

Patch Information

No patched version was available at the time of the advisory. Track the GitHub Security Advisory GHSA-87qx-9wgx-954f for release updates and apply the fix as soon as WWBN publishes it.

Workarounds

Add the u parameter to the $securityFilter list and apply HTML entity encoding before it is reflected into the response.
Deploy a strict Content Security Policy that blocks inline scripts and restricts image sources to trusted origins.
Configure WAF signatures to reject requests to confirmLivePassword.php whose u parameter contains quote characters or angle brackets.

bash

# Example NGINX rule to block quote characters in the vulnerable parameter
location /plugin/Live/confirmLivePassword.php {
    if ($arg_u ~* "[\"<>]") {
        return 403;
    }
}