CVE-2026-89241: WWBN AVideo Reflected XSS Vulnerability

CVE-2026-89241 Overview

CVE-2026-89241 is a reflected cross-site scripting (XSS) vulnerability [CWE-79] in WWBN AVideo, an open source video streaming platform. The flaw exists in confirmLivePassword.php, which copies the REQUEST_URI value into a form action attribute without HTML encoding. Attackers can craft a URL containing a quote character to break out of the attribute context and inject event handlers. Injected JavaScript executes in the victim's browser under the site origin. The vulnerability affects WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1.

Critical Impact
Successful exploitation lets attackers execute arbitrary JavaScript in an authenticated user's session, enabling session theft, credential harvesting, and unauthorized actions within the AVideo application.

Affected Products

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1
confirmLivePassword.php component in AVideo
Deployments of AVideo that expose the live password confirmation flow

Discovery Timeline

2026-09-11 - CVE-2026-89241 published to the National Vulnerability Database
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-89241

Vulnerability Analysis

The vulnerability is a reflected cross-site scripting flaw in the confirmLivePassword.php script shipped with WWBN AVideo. The script constructs an HTML <form> element whose action attribute is populated directly from the server variable REQUEST_URI. Because AVideo does not apply HTML entity encoding to that value before writing it into the response, attacker-controlled path or query characters flow into the attribute unfiltered.

An attacker can supply a request URI containing a double or single quote to terminate the action attribute early. Subsequent characters are then parsed as new HTML attributes, allowing injection of event handlers such as onmouseover, onfocus, or autofocus onload payloads. The injected handler executes JavaScript in the victim's browser within the AVideo origin.

Because the payload runs in the same origin as the authenticated user, it can read cookies not marked HttpOnly, exfiltrate session tokens, submit CSRF-protected requests, and modify the rendered page. This vulnerability requires user interaction, since the victim must load the crafted URL.

Root Cause

The root cause is missing output encoding on the REQUEST_URI value when it is reflected into an HTML attribute. AVideo trusts a client-controllable server variable and writes it verbatim into markup. Standard mitigations such as htmlspecialchars() with ENT_QUOTES on the reflected value would prevent quote characters from breaking out of the attribute.

Attack Vector

Exploitation is remote and network-based. An attacker crafts a URL targeting confirmLivePassword.php with a payload embedded in the request URI, then delivers the link via phishing email, social media, or a malicious website. When a victim with an active AVideo session visits the URL, the browser renders the page and executes the injected script. See the GitHub Security Advisory GHSA-fp9p-hrc9-8rr7 and the Vulncheck advisory for additional technical detail.

No verified public proof-of-concept code is available at this time. Refer to the linked advisories for reproduction guidance.

Detection Methods for CVE-2026-89241

Indicators of Compromise

Web server access logs containing requests to confirmLivePassword.php with encoded or literal quote characters (%22, %27, ", ') in the URI
Request URIs targeting confirmLivePassword.php that include HTML event handler substrings such as onerror=, onload=, onmouseover=, or autofocus
Referrer headers pointing to unknown external hosts followed by session anomalies for the same user
Outbound requests from browser sessions to attacker-controlled domains shortly after visiting AVideo

Detection Strategies

Deploy web application firewall (WAF) rules that inspect query strings and paths for XSS payload patterns targeting confirmLivePassword.php
Enable server-side logging of full request URIs and alert on non-standard characters within the AVideo application path
Perform authenticated dynamic application security testing (DAST) against the AVideo instance, focusing on reflected parameters and REQUEST_URI handling

Monitoring Recommendations

Monitor for spikes in requests to confirmLivePassword.php from unusual source IPs or user agents
Alert on Content Security Policy (CSP) violation reports originating from AVideo pages
Correlate suspicious URI patterns with subsequent session token reuse from unexpected geographies

How to Mitigate CVE-2026-89241

Immediate Actions Required

Update WWBN AVideo to a build newer than commit c3edcc274c389816d434acadac07ee78eaf330c1 once a fixed release is published
Place AVideo behind a WAF configured to block XSS payloads and reject requests containing raw quote characters in the URI path
Enforce a strict Content Security Policy that disallows inline event handlers and restricts script sources to trusted origins
Invalidate active user sessions and require re-authentication if exploitation is suspected

Patch Information

Refer to the WWBN AVideo GitHub Security Advisory GHSA-fp9p-hrc9-8rr7 for authoritative patch guidance and remediation commits. Administrators should track the AVideo repository for a tagged release incorporating the fix and validate that reflected REQUEST_URI values are properly encoded before deployment.

Workarounds

Restrict access to confirmLivePassword.php to authenticated administrative users at the reverse proxy layer until a patch is applied
Configure the web server to reject request URIs containing quote characters or HTML metacharacters targeting AVideo endpoints
Set the HttpOnly and Secure flags on AVideo session cookies to limit the impact of successful script injection
Deploy browser-side defenses such as CSP with default-src 'self' and script-src allowlists to constrain injected payload execution

bash

# Example NGINX rule to block quote characters in requests to confirmLivePassword.php
location ~* /confirmLivePassword\.php {
    if ($request_uri ~* "(%22|%27|\"|')") {
        return 403;
    }
}

# Example Content Security Policy header
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'";