CVE-2026-92584: AVideo Stored XSS Vulnerability

CVE-2026-92584 Overview

CVE-2026-92584 is a stored Cross-Site Scripting (XSS) vulnerability in AVideo through version 29.0 (current revision e01e41ecc). An unauthenticated attacker can inject arbitrary HTML and JavaScript into video statistics records by sending a crafted User-Agent header to the view-counter endpoint. The payload executes in the authenticated browser session of a video owner or administrator when they view the statistics page. The issue is tracked as [CWE-79] and no patched version was available at the time of disclosure.

Critical Impact
Attackers can execute arbitrary JavaScript in the authenticated sessions of AVideo administrators and video owners, enabling account takeover, session theft, and privileged actions across the platform.

Affected Products

AVideo (WWBN/AVideo) through version 29.0
Current revision e01e41ecc at time of disclosure
All deployments exposing the objects/videoAddViewCount.json.php endpoint

Discovery Timeline

2026-09-16 - CVE-2026-92584 published to NVD
2026-09-16 - Last updated in NVD database
Advisory published as GitHub Security Advisory GHSA-6rgh-c296-5j86 and VulnCheck Advisory: AVideo XSS

Technical Details for CVE-2026-92584

Vulnerability Analysis

The vulnerability resides in AVideo's view-counter flow. The unauthenticated endpoint objects/videoAddViewCount.json.php invokes VideoStatistic::save() to record a view event. During this call, AVideo captures the requester's User-Agent header via getUserAgentInfo(), which returns unrecognized agent strings verbatim without normalization.

The raw string is written directly into the app column of the videos_statistics table. The sanitizing setter setApp() is bypassed, and normalizeApp() only truncates the value to 45 characters. This 45-character window is more than sufficient to fit a working HTML event-handler payload.

When a video owner or administrator opens view/videoViewsInfo.php, the field is rendered inside a DataTables 1.12.1 column configured with an unescaped renderer. DataTables assigns cell content using innerHTML, so the stored HTML is parsed and executed in the privileged user's authenticated context.

Root Cause

The root cause is missing output encoding combined with a bypassed input sanitizer. The persistence layer writes attacker-controlled data without invoking setApp(), and the presentation layer trusts that data and injects it via innerHTML rather than as text. Neither layer enforces sanitization, so the trust boundary between anonymous HTTP requests and privileged UI rendering is broken.

Attack Vector

Exploitation requires no authentication. An attacker sends an HTTP request to objects/videoAddViewCount.json.php with a User-Agent header containing an HTML payload of up to 45 characters, such as an <img> tag with an onerror handler. The payload persists in the database until a video owner or administrator views the statistics page, at which point the script executes with that user's privileges. This enables session hijacking, forced administrative actions, and pivoting to further compromise of the AVideo instance.

No verified proof-of-concept code is published. Refer to the GitHub Security Advisory GHSA-6rgh-c296-5j86 for full technical detail.

Detection Methods for CVE-2026-92584

Indicators of Compromise

Rows in the videos_statistics table where the app column contains HTML characters such as <, >, onerror=, onload=, or <img.
Web server access logs showing POST or GET requests to objects/videoAddViewCount.json.php with User-Agent headers containing HTML tags or script-like fragments.
Unexpected outbound requests originating from administrator browser sessions shortly after visiting view/videoViewsInfo.php.

Detection Strategies

Query the videos_statistics table for app values matching regular expressions targeting HTML tags or JavaScript event handlers.
Deploy a Web Application Firewall (WAF) rule that inspects User-Agent headers on requests to videoAddViewCount.json.php and blocks values containing angle brackets or event-handler keywords.
Correlate anonymous view-counter requests with subsequent administrator authentication anomalies in the same session window.

Monitoring Recommendations

Enable verbose HTTP request logging for objects/videoAddViewCount.json.php and forward logs to a centralized SIEM for retention and analysis.
Alert on administrator sessions that trigger DOM-level script errors or unexpected navigation events after loading videoViewsInfo.php.
Track database write patterns to videos_statistics.app for values exceeding typical User-Agent character distributions.

How to Mitigate CVE-2026-92584

Immediate Actions Required

Restrict network access to objects/videoAddViewCount.json.php behind a WAF that filters HTML metacharacters in the User-Agent header.
Purge or sanitize existing rows in videos_statistics where the app column contains HTML markup before allowing administrators to view the statistics page.
Advise administrators and video owners to avoid opening view/videoViewsInfo.php until mitigations are in place.

Patch Information

No patched version was available at the time of the advisory. Monitor the GitHub Security Advisory GHSA-6rgh-c296-5j86 and the upstream WWBN/AVideo repository for a fixed release. When a patch is published, upgrade immediately and verify that VideoStatistic::save() routes User-Agent data through setApp() and that view/videoViewsInfo.php renders the app field with proper HTML escaping.

Workarounds

Apply a local code change that forces VideoStatistic::save() to call setApp() with the sanitized value instead of the raw User-Agent string.
Modify the DataTables column definition in view/videoViewsInfo.php to use an escaping renderer that treats the app value as text rather than HTML.
Deploy a reverse-proxy rule that strips or rejects User-Agent headers containing <, >, or on[a-z]+= patterns on requests to the view-counter endpoint.

bash

# Example WAF rule (ModSecurity) blocking HTML in User-Agent for the affected endpoint
SecRule REQUEST_URI "@endsWith /objects/videoAddViewCount.json.php" \
    "phase:1,chain,deny,status:403,id:1092584,msg:'CVE-2026-92584 AVideo XSS via User-Agent'"
    SecRule REQUEST_HEADERS:User-Agent "@rx (?i)(<[a-z!/]|on[a-z]+\s*=|javascript:)" \
        "t:none"