CVE-2026-89243: WWBN AVideo Stored XSS Vulnerability

CVE-2026-89243 Overview

CVE-2026-89243 is a stored cross-site scripting (XSS) vulnerability in WWBN AVideo, an open-source video streaming platform. The flaw resides in the UserGroups::setGroup_name() method, which fails to sanitize the group_name input before persisting it. Administrators holding the canAdminUserGroups permission can inject HTML and JavaScript that later executes in the browsers of other administrators viewing the user manager interface. The issue affects AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1. The vulnerability is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
A privileged attacker can persist JavaScript that runs in other administrators' sessions, enabling account takeover, privilege abuse, and lateral compromise of the AVideo installation.

Affected Products

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1
AVideo deployments exposing the user manager interface to multiple administrators
Installations where the canAdminUserGroups permission is delegated to non-trusted admin roles

Discovery Timeline

2026-09-11 - CVE-2026-89243 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-89243

Vulnerability Analysis

The vulnerability lives in the UserGroups::setGroup_name() setter used to create or rename user groups in AVideo. The method assigns caller-controlled input directly to the group_name property without HTML encoding or allow-listing. When the value is later rendered in the user manager interface, the browser interprets attacker-supplied markup and scripts as trusted content.

Because the payload is persisted server-side, it fires every time an administrator loads the affected view. This produces a stored XSS condition with cross-tenant impact inside the admin console. Successful exploitation yields JavaScript execution under an authenticated administrator's origin, which can be leveraged to read session data, invoke privileged endpoints, or modify user group configurations.

Root Cause

The root cause is missing output encoding and input sanitization on the group_name field in UserGroups::setGroup_name(). The setter treats the value as trusted text and stores it verbatim. Downstream rendering in the user manager likewise omits contextual escaping, so injected <script> tags, event handlers, and HTML attributes are emitted directly into the DOM.

Attack Vector

An authenticated administrator with the canAdminUserGroups permission submits a crafted group name containing HTML or JavaScript. The value is written to the AVideo database through the vulnerable setter. When any other administrator navigates to the user manager, the payload executes in their browser session. Exploitation requires high privileges and user interaction from the victim administrator, but it enables persistence and privilege chaining against the platform.

No verified public exploit code is available. See the GitHub Security Advisory GHSA-qm3h-2jrx-xmg6 and the VulnCheck advisory for additional technical detail.

Detection Methods for CVE-2026-89243

Indicators of Compromise

Database rows in the users_groups table containing group_name values with <, >, on*=, javascript:, or <script> substrings.
HTTP POST requests to AVideo admin endpoints that create or update user groups with payloads carrying HTML tags in the group_name parameter.
Unexpected outbound requests from administrator browser sessions after visiting the user manager view.

Detection Strategies

Inspect application logs for administrator actions that create or rename user groups and flag names containing markup characters.
Deploy a web application firewall rule that blocks HTML control characters in the group_name parameter on AVideo admin routes.
Query the AVideo database directly for stored group_name values that do not conform to an expected allow-list of alphanumeric and whitespace characters.

Monitoring Recommendations

Alert on canAdminUserGroups permission grants and audit which administrators currently hold that role.
Monitor administrator session activity for anomalous API calls originating shortly after user manager page loads.
Track file and configuration changes made by administrator accounts to detect script-driven privilege abuse.

How to Mitigate CVE-2026-89243

Immediate Actions Required

Restrict the canAdminUserGroups permission to a minimal set of vetted administrators until a fix is deployed.
Audit the users_groups table for existing group_name values that contain HTML or JavaScript and sanitize them.
Update AVideo to a commit newer than c3edcc274c389816d434acadac07ee78eaf330c1 once an upstream patch is available.

Patch Information

Refer to the WWBN AVideo GitHub Security Advisory GHSA-qm3h-2jrx-xmg6 for authoritative patch status and remediation guidance. The VulnCheck advisory provides supplementary technical context. Administrators should pull the latest AVideo revision from the upstream repository and rebuild affected deployments.

Workarounds

Enforce a strict Content Security Policy on AVideo administrative routes to block inline scripts and untrusted event handlers.
Place the AVideo admin interface behind a reverse proxy that strips or rejects HTML metacharacters in the group_name field.
Reduce the number of concurrent administrator accounts and require step-up authentication before accessing the user manager view.

bash

# Example nginx rule to reject group_name values containing HTML metacharacters
location /objects/userGroupsAddNew.json.php {
    if ($arg_group_name ~* "[<>\"']|script|onerror|onload|javascript:") {
        return 403;
    }
    proxy_pass http://avideo_backend;
}