CVE-2026-89255: AVideo LoginControl Stored XSS via PGP Public Key
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LoginControl plugin that fails to HTML-encode PGP public keys echoed into a textarea element. An authenticated attacker can inject malicious JavaScript by submitting a crafted public key, which executes in an administrator's session when viewing the user's profile tab.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
AVideo deployments using the LoginControl plugin are exposed if administrators view the profile tab of a user who has submitted a crafted PGP public key. The attacker must have an authenticated account capable of submitting that key.
What does an attacker need to exploit it?
The attacker needs low-privileged authenticated access and must convince or wait for an administrator to view the attacker-controlled user's profile tab. Exploitation relies on submitting a PGP public key containing malicious JavaScript.
Are administrators directly affected?
The injected script executes in the administrator's browser session when the administrator views the affected user's profile tab. This can expose the administrator's session and allow actions with that session's privileges.