CVE-2026-89247 Overview
CVE-2026-89247 is an XML injection vulnerability [CWE-91] in WWBN AVideo affecting commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier. The flaw resides in plugin/AD_Server/VMAP.php and is reachable without authentication when the AD_Server plugin is enabled. Attacker-controlled timeOffset and idTag values are written directly into VMAP attributes without encoding. A remote attacker can inject arbitrary <vmap:AdBreak> and <vmap:AdTagURI> nodes into the generated XML. The player then requests attacker-supplied ad URLs during victim playback. The issue was unfixed at the time of reporting.
Critical Impact
Unauthenticated attackers can inject malicious ad tags into video playback sessions, triggering cross-origin requests and ad injection from the victim's browser context.
Affected Products
- WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier
- Deployments with the AD_Server plugin enabled
- The plugin/AD_Server/VMAP.php endpoint
Discovery Timeline
- 2026-09-11 - CVE-2026-89247 published to NVD
- 2026-09-15 - Last updated in NVD database
Technical Details for CVE-2026-89247
Vulnerability Analysis
The vulnerability exists in the plugin/AD_Server/VMAP.php script, which emits a Content-Type: application/xml response. The script writes timeOffset and idTag values returned by AD_Server::getVMAPSFromRequest() directly into VMAP attributes without XML encoding. Because output encoding is missing, attacker-supplied strings can close attributes and introduce new XML nodes. The classification aligns with [CWE-91] XML Injection.
The attack requires user interaction: a victim must open a crafted VMAP URL or a video page consuming it. Once triggered, the player's IMA (Interactive Media Ads) path invokes afterVideoJS -> PlayerSkins::setIMAADTag, which fetches the injected ad URLs. This produces cross-origin requests originating from the victim's authenticated playback session.
Root Cause
The input source is the $_REQUEST['vmaps'] parameter, which is base64-decoded and then JSON-decoded before use. This parameter is not covered by $securityFilter in objects/security.php, so sanitization routines never inspect its contents. When a VAST.campaing entry contains crafted characters, those values propagate unchanged into the generated XML attributes. The absence of contextual output encoding for XML attribute contexts is the direct root cause.
Attack Vector
An unauthenticated remote attacker constructs a vmaps payload containing a non-empty VAST.campaing entry with XML metacharacters in timeOffset or idTag fields. The attacker delivers the crafted URL to a victim through phishing, a malicious link, or an embedded video reference. When the victim's browser loads the VMAP response, injected <vmap:AdBreak> and <vmap:AdTagURI>/AdSource nodes cause the IMA player to request attacker-controlled ad servers. This enables ad injection and forced cross-origin requests from the victim's session context.
No verified exploit code is publicly available. Refer to the GitHub Security Advisory and the VulnCheck Advisory on XML Injection for authoritative technical detail.
Detection Methods for CVE-2026-89247
Indicators of Compromise
- HTTP requests to plugin/AD_Server/VMAP.php containing a vmaps query parameter with base64-encoded JSON payloads.
- VMAP responses containing unexpected <vmap:AdTagURI> or <vmap:AdBreak> nodes referencing external ad domains not configured by administrators.
- Outbound requests from user browsers to unknown ad-serving hosts immediately following video page loads.
Detection Strategies
- Inspect web server access logs for requests to VMAP.php with unusually large or encoded vmaps parameters.
- Decode captured vmaps parameter values and inspect for XML metacharacters such as ", >, or < in timeOffset and idTag fields.
- Compare generated VMAP XML output against expected campaign configurations to identify injected ad break entries.
Monitoring Recommendations
- Enable application-level logging for the AD_Server plugin and alert on non-empty VAST.campaing entries from untrusted sources.
- Monitor egress traffic from client sessions for ad-tag URL fetches to domains outside an approved allowlist.
- Correlate referrer and session data with abnormal ad-request patterns using centralized log analytics.
How to Mitigate CVE-2026-89247
Immediate Actions Required
- Disable the AD_Server plugin in AVideo installations until an upstream fix is available.
- Restrict network access to plugin/AD_Server/VMAP.php at the web server or reverse proxy layer.
- Add the vmaps request parameter to $securityFilter in objects/security.php to enforce sanitization.
Patch Information
At the time of reporting, no vendor patch was available. Track the GitHub Security Advisory for remediation updates from WWBN. Administrators should subscribe to the AVideo repository release feed and apply any commit that XML-encodes timeOffset and idTag values before writing them to the VMAP response.
Workarounds
- Deploy a web application firewall rule to block requests to VMAP.php containing base64 payloads with XML metacharacters after decoding.
- Enforce a strict Content Security Policy on video player pages to limit outbound ad-tag fetches to trusted domains.
- Remove or rename plugin/AD_Server/VMAP.php if the advertising feature is not required for the deployment.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
