CVE-2026-89254: AVideo CustomizeUser Plugin XSS Vulnerability

CVE-2026-89254 Overview

CVE-2026-89254 is a stored cross-site scripting (XSS) vulnerability in AVideo, an open-source video streaming platform. The flaw exists in the CustomizeUser plugin, where the field_name parameter submitted to the add.json.php endpoint is stored without sanitization. Authenticated administrators can inject arbitrary JavaScript that executes when other users load extra info pages or profile forms rendered by the typeToHTML function. The vulnerability is classified under [CWE-79] and affects AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1.

Critical Impact
Persistent JavaScript payloads execute in victim browsers, enabling session theft, account takeover, and lateral compromise of AVideo user accounts including other administrators.

Affected Products

AVideo platform through commit c3edcc274c389816d434acadac07ee78eaf330c1
AVideo CustomizeUser plugin (add.json.php endpoint)
Deployments rendering user profile fields via the typeToHTML function

Discovery Timeline

2026-09-11 - CVE-2026-89254 published to the National Vulnerability Database
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-89254

Vulnerability Analysis

The vulnerability resides in the CustomizeUser plugin bundled with AVideo. The add.json.php endpoint accepts a field_name parameter from authenticated administrator requests and persists the value directly to the database. AVideo does not encode or filter the input at storage time, nor does it escape the value at render time.

When the stored field is later retrieved and passed through the typeToHTML function, the raw payload is emitted into the HTML response. Any JavaScript inserted through field_name executes in the browser of every user who loads the extra info page or profile form referencing that field. Because the payload is server-persisted, exploitation does not require re-delivery per victim.

The attack requires low privileges (administrator on the AVideo instance) and user interaction from a victim who visits a page rendering the malicious field. Impact extends beyond the vulnerable component because the injected script runs in the security context of the AVideo application, allowing modification of DOM content, exfiltration of session cookies, and forced administrative actions.

Root Cause

The root cause is missing output encoding and input sanitization on the field_name parameter across the write and read paths of the CustomizeUser plugin. AVideo trusts administrator-supplied field metadata and forwards it directly to typeToHTML, which concatenates the value into HTML without contextual escaping.

Attack Vector

An authenticated administrator submits a crafted POST request to the add.json.php endpoint with a JavaScript payload in the field_name parameter. AVideo stores the payload. When any user, including other administrators, subsequently loads the affected profile or extra info page, the browser parses and executes the injected script. See the GitHub Security Advisory GHSA-7hj4-f9x4-gg7p and the VulnCheck Stored XSS Advisory for technical details.

Detection Methods for CVE-2026-89254

Indicators of Compromise

Requests to /plugin/CustomizeUser/add.json.php containing HTML control characters, <script> tags, or JavaScript event handlers in the field_name parameter.
Database rows in CustomizeUser plugin tables where field_name contains angle brackets, javascript: URIs, or encoded script fragments.
Unexpected outbound requests from browsers loading AVideo profile or extra info pages, indicating exfiltration by an injected payload.

Detection Strategies

Inspect web server and application logs for POST requests to the add.json.php endpoint with payload lengths or characters inconsistent with normal field names.
Run static queries against the AVideo database for stored field values containing markup, and flag any that render inside typeToHTML output.
Deploy a Content Security Policy (CSP) in report-only mode and monitor violation reports for inline script execution originating from profile pages.

Monitoring Recommendations

Alert on administrator account activity that creates or modifies custom user fields outside of change windows.
Track browser telemetry for unexpected DOM modifications, cookie access, or redirects triggered on AVideo profile URLs.
Correlate administrator session anomalies, such as new IP addresses or user-agent strings, with CustomizeUser write operations.

How to Mitigate CVE-2026-89254

Immediate Actions Required

Restrict access to the AVideo administrative interface to trusted networks and enforce multi-factor authentication for all administrator accounts.
Audit existing CustomizeUser plugin entries and remove any field_name values containing HTML or JavaScript syntax.
Rotate administrator session tokens and credentials if unauthorized modifications to custom fields are identified.

Patch Information

At the time of publication, AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 is affected. Monitor the GitHub Security Advisory GHSA-7hj4-f9x4-gg7p for the fixed commit and upgrade AVideo to the patched version once released by the WWBN project.

Workarounds

Disable the CustomizeUser plugin until a patched release is available if custom user fields are not required.
Deploy a strict Content Security Policy that forbids inline scripts and untrusted script sources to reduce XSS impact.
Place a web application firewall rule in front of /plugin/CustomizeUser/add.json.php that rejects requests containing <, >, or javascript: in the field_name parameter.

bash

# Example WAF rule (ModSecurity) blocking script markup in field_name
SecRule REQUEST_URI "@endsWith /plugin/CustomizeUser/add.json.php" \
    "phase:2,chain,deny,status:403,id:1026089254,\
     msg:'CVE-2026-89254 CustomizeUser field_name XSS attempt'"
  SecRule ARGS:field_name "@rx (?i)(<script|javascript:|on[a-z]+\s*=)" \
      "t:none,t:urlDecodeUni"