CVE-2026-89239: WWBN AVideo Reflected XSS via Referer Header Comment Breakout
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in the showAlertMessage() function that inserts the raw Referer header into a JavaScript comment without encoding. Attackers can craft a Referer header containing / to close the comment and inject arbitrary JavaScript that executes in the site origin for visitors arriving from the attacker-controlled page.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
AVideo instances containing commit c3edcc274c389816d434acadac07ee78eaf330c1 are exposed when a visitor reaches the site with an attacker-controlled Referer header. The attacker does not need prior privileges, but victim interaction is required.
What does exploitation require?
An attacker must cause a victim to arrive from an attacker-controlled page or otherwise send a crafted Referer header. The Referer value must include */ to terminate the JavaScript comment, allowing injected JavaScript to execute in the AVideo site origin.
What is the potential impact if exploitation succeeds?
Injected script executes with the affected AVideo site's origin in the victim's browser. The available data rates confidentiality and integrity impact as low and does not identify an availability impact.
How can I determine whether an instance is affected?
Check whether the deployed AVideo code includes commit c3edcc274c389816d434acadac07ee78eaf330c1 and whether showAlertMessage() places the Referer header into a JavaScript comment without encoding. The provided data does not identify affected release versions or a fixed version.