WWBN AVideo CVE-2026-84477

Injection of the XSS payload requires an account with streaming permission on the target AVideo instance (PR:L per CVSS 4.0). This account can be legitimately registered or obtained via compromise of an existing streamer account - no administrative privilege is required. Once a payload is stored, triggering execution requires only that a victim passively visits remindMe.php (UI:P); this endpoint carries no authentication requirement, so any browser - including unauthenticated sessions - that loads it is at risk. No non-default AVideo configuration is required beyond the existence of at least one streaming-permission account. The key limiting factor is the credentialed write step: tightly controlled deployments where streaming access is limited to a small trusted set have meaningfully reduced exposure.

The CVSS 4.0 score of 5.1 (Medium) with vector AV:N/AC:L/AT:N/PR:L/UI:P captures the real-world shape of this vulnerability well. The attack is constrained at the injection stage - an active streaming-permission account is required - but the execution stage is unconstrained: any user who passively loads remindMe.php is affected regardless of authentication status, broadening the potential victim pool to the entire user base and anonymous visitors. Downstream XSS impact is typically session token theft, credential phishing, or DOM manipulation limited to the victim browser (VC:L/VI:L in CVSS 4.0 terms). No KEV listing, no EPSS data, and no public POC are present in the available intelligence, indicating this is not currently a known exploited-in-the-wild issue. The practical risk is elevated for AVideo deployments with open user registration or many streaming accounts, but constrained for tightly controlled single-organization instances.

An attacker registers or compromises an AVideo account with streaming permission, then issues a POST request to the Live_schedule endpoint with a JavaScript payload embedded in the title or description field. The script is stored in the database without sanitization. When any site visitor - authenticated or not - navigates to remindMe.php, their browser fetches and executes the stored payload, enabling the attacker to exfiltrate session cookies or perform actions in the victim's browser context. No public POC has been identified at time of analysis.