WWBN AVideo CVE-2026-82646

No authentication is required - this is an unauthenticated reflected XSS (CVSS PR:N confirmed). The url2Embed.json.php endpoint must be publicly reachable from the attacker's vantage point; if the AVideo instance is deployed on an intranet without external exposure, the attack surface is significantly reduced. Exploitation requires passive user interaction: a legitimate user with an active authenticated session must click or load the attacker-crafted link (CVSS UI:P). The attack leverages AVideo's own evideo payload encryption to encode the malicious markup, so no special attacker infrastructure is required beyond a web server to receive exfiltrated tokens. Exploitation is limited to sessions where users are logged in; unauthenticated visitors have no cookies or CSRF tokens worth stealing, reducing the practical value of attacking those sessions.

The CVSS 4.0 score of 5.3 (Medium) is consistent with the actual risk profile: network-accessible, no privileges required, but requiring passive user interaction (UI:P) to click a crafted link. The EPSS score is not provided in the available data, so exploitation probability cannot be quantified. There is no CISA KEV listing and no confirmed public exploit code, meaning this is a medium-urgency finding without evidence of active weaponization. The most significant real-world risk amplifier is the same-origin delivery mechanism: because the crafted link resolves to the victim's own AVideo instance domain, browser same-origin protections do not mitigate JavaScript access to session cookies and CSRF tokens, making this more impactful than a typical reflected XSS that requires an obviously foreign domain. The CVSS scope change (S:C in 3.1 terms; SC:L/SI:L in 4.0) reflects this cross-context impact. Overall this is a genuine medium-priority finding - not a high-CVSS-low-risk paper vulnerability - and organizations should prioritize patching based on whether their AVideo instance handles authenticated user sessions with sensitive cookies.

An attacker crafts a URL targeting the url2Embed.json.php endpoint with an encrypted evideo parameter embedding a malicious script payload (e.g., a cookie-exfiltrating XHR call). The attacker distributes this URL via phishing email or a social post, where it appears to link to the victim organization's own AVideo domain. When an authenticated user clicks the link, the AVideo server reflects the unescaped payload back into the page, executing the attacker's JavaScript in the user's browser session and forwarding session cookies to an attacker-controlled server.