CVE-2026-85159: AVideo Reflected XSS via cancelUri in userLogin.php
AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php where the cancelUri parameter is echoed in an href attribute after isSafeRedirectURL checks protocol only, not HTML characters. Unauthenticated attackers can inject event handlers via relative URLs with embedded quotes to execute arbitrary JavaScript when users interact with the Cancel button.
Affected Software
Event History
Frequently Asked Questions
Does an attacker need an account to exploit this issue?
No. The vulnerability can be exploited by an unauthenticated attacker.
What must a victim do for the attack to execute?
The victim must interact with the Cancel button after being presented with a crafted cancelUri value. The issue has a user-interaction requirement.
What kind of payload can bypass the redirect validation?
A relative URL containing embedded quote characters can pass the protocol-only validation and inject an event handler into the rendered href attribute.