CVE-2026-89255 Overview
CVE-2026-89255 is a stored cross-site scripting [CWE-79] vulnerability in AVideo, an open-source video streaming platform. The flaw resides in the LoginControl plugin, which fails to HTML-encode Pretty Good Privacy (PGP) public keys before rendering them inside a textarea element. An authenticated attacker can submit a crafted PGP public key containing malicious JavaScript. The payload executes in an administrator's browser session when the administrator views the attacker-controlled user profile tab.
Critical Impact
Successful exploitation permits session hijacking, administrative action forgery, and full compromise of the AVideo administrative interface through code execution in a privileged user's browser.
Affected Products
- AVideo platform through commit c3edcc274c389816d434acadac07ee78eaf330c1
- AVideo LoginControl plugin
- Deployments exposing user profile administration to authenticated users
Discovery Timeline
- 2026-09-11 - CVE-2026-89255 published to the National Vulnerability Database
- 2026-09-11 - Last updated in NVD database
Technical Details for CVE-2026-89255
Vulnerability Analysis
The vulnerability exists in the AVideo LoginControl plugin, which accepts a PGP public key as part of a user's profile settings. The plugin stores the value and later renders it inside a textarea HTML element without applying context-appropriate output encoding. Because HTML parsing rules inside a textarea still terminate on the closing </textarea> tag, an attacker can escape the element and inject arbitrary HTML and JavaScript. The payload is persisted server-side, so it fires whenever a privileged user opens the attacker's profile tab.
Root Cause
The root cause is missing output sanitization on user-supplied data ([CWE-79]). The LoginControl plugin echoes the stored PGP public key directly into markup without invoking an HTML-encoding function such as htmlspecialchars. Any bytes provided by the attacker are treated as literal HTML by the browser.
Attack Vector
Exploitation requires an authenticated account on the AVideo instance and interaction from a higher-privileged user, typically an administrator opening the user's profile view. The attacker submits a PGP public key value containing an early </textarea> closer followed by a <script> block or event-handler markup. When an administrator navigates to the profile, the injected script executes with the administrator's session cookies and origin, enabling account takeover, privilege escalation within the application, and further pivoting into the platform. Refer to the GitHub Security Advisory and the VulnCheck Advisory for additional technical detail.
Detection Methods for CVE-2026-89255
Indicators of Compromise
- Profile records or database rows containing </textarea>, <script, or HTML event-handler substrings within the PGP public key field.
- Outbound requests from administrator browsers to unknown domains shortly after loading a user profile page.
- Unexpected administrative actions such as new user creation, role changes, or plugin configuration edits following profile views.
Detection Strategies
- Query the AVideo database for LoginControl profile entries whose PGP public key value does not match the expected PGP armor format -----BEGIN PGP PUBLIC KEY BLOCK-----.
- Inspect web server access logs for POST requests to profile update endpoints containing HTML-escaping bypass characters such as <, >, and /.
- Deploy web application firewall rules that flag script tags or event handlers submitted to user profile fields.
Monitoring Recommendations
- Alert on privileged session activity that originates immediately after an administrator opens a non-admin user profile.
- Enable Content Security Policy (CSP) reporting to capture inline script violations sourced from AVideo pages.
- Continuously review audit logs for administrative changes performed from unusual user agents or IP addresses.
How to Mitigate CVE-2026-89255
Immediate Actions Required
- Update AVideo to a commit newer than c3edcc274c389816d434acadac07ee78eaf330c1 that includes a fix for the LoginControl plugin.
- Disable the LoginControl plugin until patched if the vendor release cannot be applied immediately.
- Audit existing user profiles for stored PGP public key values containing HTML markup and purge malicious entries.
- Rotate administrative session tokens and credentials that may have been exposed to injected script.
Patch Information
Remediation guidance is published in the GitHub Security Advisory GHSA-gq4h-vw2w-9rx3. Administrators should track the AVideo repository for a commit that HTML-encodes the PGP public key output within the LoginControl plugin templates.
Workarounds
- Restrict registration of new accounts and require administrator approval before profiles become visible.
- Enforce a strict Content Security Policy that blocks inline scripts on AVideo administrative pages.
- Manually validate submitted PGP public keys against the expected ASCII-armor format before persisting them.
# Configuration example
# Example Content Security Policy header for AVideo (Apache)
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.