CVE-2026-89255 WWBN CVE debrief

Who should care

Defenders responsible for AVideo instances should assess exposure and prioritize updates to prevent exploitation. This includes administrators, security teams, and vulnerability management teams who oversee AVideo deployments. They should verify the presence of vulnerable components, plan for updates or mitigations, and monitor for suspicious activity. Additionally, operators and platform administrators should be aware of the potential impact on their AAVI

Why it matters

AVideo's LoginControl plugin vulnerability allows authenticated attackers to inject malicious JavaScript, impacting administrators viewing user profiles.

• Execution of malicious JavaScript in administrator sessions
• Potential for unauthorized actions
• Required verification of AVideo instances
• Need for prompt updates to prevent exploitation

Technical summary

The LoginControl plugin in AVideo fails to HTML-encode PGP public keys, allowing an authenticated attacker to inject malicious JavaScript. This vulnerability exists in AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1. The injected JavaScript executes in an administrator's session when viewing the user's profile tab, potentially leading to unauthorized actions. Defenders should prioritize verifying and updating AVideo instances to prevent exploitation. The vulnerability is being tracked by CVE-2026-89255.

Defensive priority

Defenders should prioritize verifying and updating AVideo instances to prevent exploitation.

Recommended defensive actions

• Verify AVideo instances for vulnerability
• Update AVideo to the latest version
• Monitor for suspicious activity
• Restrict user input to prevent exploitation
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability exists in AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1. The LoginControl plugin fails to HTML-encode PGP public keys echoed into a textarea element. This allows an authenticated attacker to inject malicious JavaScript, which executes in an administrator's session when viewing the user's profile tab. The vulnerability was publicly disclosed and is being tracked by CVE-2026-89255.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.