CVE-2026-89249: AVideo YPTWallet Plugin Stored XSS Vulnerability

CVE-2026-89249 Overview

CVE-2026-89249 is a stored cross-site scripting vulnerability in the AVideo open-source video platform. The flaw resides in the YPTWallet plugin, which base64-encodes user-supplied CryptoWallet values but fails to HTML-escape them before storing them in the wallet_log.information table. When administrators view pending withdrawal requests through pendingRequests.php, the stored markup executes in their authenticated session. Attackers can then issue same-origin fetch requests to perform administrative actions. The vulnerability is present through commit c3edcc274c389816d434acadac07ee78eaf330c1 and is classified under [CWE-79].

Critical Impact

A low-privileged user can inject script payloads that execute in an administrator's browser, enabling account takeover and full compromise of the AVideo instance.

Affected Products

• AVideo platform (WWBN/AVideo)
• YPTWallet plugin
• All builds through commit c3edcc274c389816d434acadac07ee78eaf330c1

Discovery Timeline

• 2026-09-11 - CVE-2026-89249 published to the National Vulnerability Database (NVD)
• 2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-89249

Vulnerability Analysis

AVideo is an open-source video streaming and broadcasting platform. The YPTWallet plugin enables users to configure cryptocurrency wallet addresses for receiving withdrawal payouts. When a user submits a CryptoWallet value, the application base64-encodes the input as a lightweight obfuscation step and writes the encoded blob into the wallet_log.information column. The application decodes the value on retrieval but does not apply HTML entity escaping before rendering it in the administrator interface.

The pendingRequests.php administrative page enumerates pending withdrawal requests and reflects the decoded CryptoWallet content directly into the DOM. Any HTML or JavaScript embedded in the original submission executes in the administrator's browser context under the AVideo origin. Because the payload runs with the administrator's session cookies, attacker-controlled JavaScript can perform same-origin fetch calls against privileged endpoints to create users, modify configurations, or exfiltrate data.

Root Cause

The root cause is missing output encoding on data returned from persistent storage. Base64 encoding is not a security control; it neutralizes storage-format issues but does not sanitize markup. The plugin conflates encoding with escaping, leaving the rendered administrative view vulnerable to script execution ([CWE-79]).

Attack Vector

Exploitation requires an authenticated low-privileged account that can submit a withdrawal request with an arbitrary CryptoWallet value. The attacker crafts a value containing script markup, base64-encodes it if necessary to bypass any input-side filters, and submits the withdrawal. The payload remains dormant in wallet_log.information until an administrator opens pendingRequests.php, at which point the browser parses the injected markup and executes attacker JavaScript in the administrative session.

Technical specifics are documented in the GitHub Security Advisory GHSA-fvp5-q9jp-29mx and the VulnCheck Advisory on the YPTWallet stored XSS.

Detection Methods for CVE-2026-89249

Indicators of Compromise

• Entries in the wallet_log table where the decoded information field contains HTML tags such as <script>, <img onerror=, or <svg onload=.
• Unexpected administrative actions (new admin accounts, permission changes, configuration edits) originating from an administrator IP shortly after pendingRequests.php was accessed.
• Outbound HTTP requests from administrator browsers to unfamiliar domains immediately after opening the pending withdrawals view.

Detection Strategies

• Query the wallet_log table for base64-decoded values that contain angle brackets, event handler attributes, or javascript: URIs.
• Inspect web server access logs for POST requests to withdrawal endpoints followed by administrator GET requests to pendingRequests.php.
• Deploy a Content Security Policy (CSP) in report-only mode to surface inline script executions in the AVideo admin console.

Monitoring Recommendations

• Audit administrator sessions for anomalous fetch or XMLHttpRequest activity against privileged AVideo endpoints.
• Alert on newly created administrator accounts or role changes that occur outside standard change windows.
• Correlate wallet configuration changes with subsequent administrator activity to identify potential exploitation chains.

How to Mitigate CVE-2026-89249

Immediate Actions Required

• Update AVideo to a revision later than commit c3edcc274c389816d434acadac07ee78eaf330c1 that addresses the missing output encoding in the YPTWallet plugin.
• Review the wallet_log table and purge or sanitize any entries containing HTML markup in the decoded information field.
• Restrict access to the YPTWallet plugin and withdrawal features to trusted user roles until the patch is applied.

Patch Information

Refer to the GitHub Security Advisory GHSA-fvp5-q9jp-29mx for the authoritative patch reference and remediated commit. Apply the vendor-provided fix that HTML-escapes the decoded CryptoWallet value before rendering in pendingRequests.php.

Workarounds

• Disable the YPTWallet plugin if cryptocurrency withdrawals are not required in the deployment.
• Deploy a strict Content Security Policy that forbids inline scripts on administrative pages to blunt payload execution.
• Place a web application firewall (WAF) rule in front of AVideo that inspects decoded CryptoWallet submissions for HTML tags and blocks matching requests.

# Example CSP header to block inline script execution on admin pages
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'