CVE-2026-89253: WWBN AVideo Stored XSS Vulnerability

CVE-2026-89253 Overview

CVE-2026-89253 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in WWBN AVideo, an open-source video streaming platform. The flaw exists in the user donationLink profile field through commit c3edcc274c389816d434acadac07ee78eaf330c1. An authenticated user can inject a malicious payload into their profile that executes JavaScript in the browser of any visitor, including administrators, who interacts with the donation button on the watch page. The issue was unfixed at the time of reporting. Exploitation requires the CustomizeUser plugin option allowDonationLink to be enabled.

Critical Impact
Authenticated attackers can execute arbitrary JavaScript in an administrator's browser session, enabling account takeover and full compromise of the AVideo instance.

Affected Products

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1
Instances with the CustomizeUser plugin enabled
Deployments where the allowDonationLink option is active

Discovery Timeline

2026-09-11 - CVE-2026-89253 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-89253

Vulnerability Analysis

The vulnerability arises from insufficient output encoding of user-supplied URL data rendered inside an HTML attribute. AVideo's User::setDonationLink() function in objects/user.php stores the raw value submitted by an authenticated user. The save() routine validates the input only with filter_var(..., FILTER_VALIDATE_URL), which accepts URLs containing embedded double quotes and HTML control characters. A payload such as http://evil.example/"onmouseover=alert(document.domain)// passes validation.

On retrieval, getDonationLink() applies only strip_tags() and does not encode double quotes or HTML entities. The plugin/CustomizeUser/actionButton.php component then echoes the value unencoded into an <a href="..."> attribute. The donation button is rendered from view/modeYoutubeBottom.php on every watch page. Any visitor who hovers over the donation button triggers the injected event handler in the context of the site's origin.

Root Cause

The root cause is a failure to apply context-appropriate output encoding. FILTER_VALIDATE_URL is not a sanitizer, and strip_tags() does not neutralize attribute-breaking characters like double quotes. Escaping with htmlspecialchars($url, ENT_QUOTES, 'UTF-8') before echoing into the href attribute would prevent attribute breakout.

Attack Vector

An authenticated attacker updates their profile via objects/userUpdate.json.php with a crafted donationLink value. When a victim visits any of the attacker's videos and interacts with the donation button, the injected JavaScript executes. Because the payload runs in the victim's authenticated session, an administrator target enables session theft, CSRF against privileged endpoints, and pivoting to remote code execution through AVideo's administrative functionality.

See the GitHub Security Advisory GHSA-34jx-r3p9-7pp2 and the VulnCheck AVideo XSS Advisory for full technical details.

Detection Methods for CVE-2026-89253

Indicators of Compromise

Values in the users.donationLink database column containing double quotes, on*= event handler substrings, or javascript: schemes.
HTTP POST requests to objects/userUpdate.json.php where the donationLink parameter contains ", <, or HTML event handler names.
Rendered <a> tags in watch page HTML where the href attribute is broken by unescaped quotes or contains inline event handler attributes.

Detection Strategies

Audit the users table for any donationLink values that do not conform to a strict URL pattern (scheme, host, path only).
Deploy a web application firewall rule inspecting donationLink POST parameters for characters ", <, >, and on\w+= patterns.
Review web server access logs for repeated hits to /objects/userUpdate.json.php from newly created or low-reputation accounts.

Monitoring Recommendations

Alert on any modification of the donationLink field and require manual review before the value is rendered on public pages.
Enable Content Security Policy (CSP) reporting to surface inline event handler executions on the watch page.
Monitor administrator sessions for anomalous API activity originating shortly after viewing user-uploaded video content.

How to Mitigate CVE-2026-89253

Immediate Actions Required

Disable the CustomizeUser plugin or set the allowDonationLink option to false until a fix is applied.
Sanitize existing donationLink values in the database by removing entries that contain quotes, angle brackets, or event handler substrings.
Restrict administrator accounts from browsing untrusted user-uploaded content in the same browser profile used for administrative tasks.

Patch Information

The issue was unfixed at the time of reporting. Track the GitHub Security Advisory GHSA-34jx-r3p9-7pp2 for patch availability. When a patch is released, the fix should apply htmlspecialchars() with ENT_QUOTES to the donationLink value inside plugin/CustomizeUser/actionButton.php and enforce strict URL parsing in User::setDonationLink().

Workarounds

Deploy a strict Content Security Policy that blocks inline event handlers and inline scripts on watch pages.
Add a reverse proxy or WAF rule that strips or rejects donationLink values containing ", <, >, or on\w+= tokens.
Temporarily patch plugin/CustomizeUser/actionButton.php locally to wrap the URL output in htmlspecialchars($url, ENT_QUOTES, 'UTF-8').

bash

# Configuration example: disable the vulnerable feature via AVideo admin
# Navigate to Admin -> Plugins -> CustomizeUser and set:
#   allowDonationLink = false
# Or update the plugin configuration in the database:
UPDATE plugins
  SET object_data = REPLACE(object_data, '"allowDonationLink":true', '"allowDonationLink":false')
  WHERE name = 'CustomizeUser';