CVE-2026-88866: WWBN AVideo LoginControl Stored XSS via User-Agent Header
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LoginControl plugin that fails to encode the User-Agent header before storing it in login history. Attackers with any valid login account can inject malicious scripts in the User-Agent header that execute in administrator browsers when viewing the Login History page, allowing script execution within the administrator session.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue, and what interaction is required?
An attacker needs any valid AVideo login account and must be able to submit a crafted User-Agent header during login. Exploitation requires an administrator to later open the Login History page containing the stored header.
What is the impact once the payload executes?
The injected script executes in the administrator's browser session. This can enable script actions with the administrator's session privileges.
How can administrators determine whether they may already be affected?
Review Login History entries for unexpected or suspicious User-Agent values, particularly values containing script-like content. The vulnerable behavior is present in AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1.