AVideo CVE-2026-88868

Requires an account with the canStream permission on the target AVideo instance (PR:L - not anonymous), and a victim must view the attacker-created live-link page for the stored payload to fire (UI required). The vulnerable surface is specifically the LiveLinks plugin's title and description fields, so the plugin must be in use; impact is maximized when higher-privileged users such as administrators view the page. Limiting factors: attacker needs streaming privileges, victim interaction is mandatory, and exploitation is confined to the site origin.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/SC:H/SI:H, score 9.3) reflects network reachability, low attacker privilege (canStream), and the fact that the payload crosses into victim sessions (subsequent-system impact). The realistic risk is elevated by the target set: because administrators viewing the live-link page execute the payload, this is a plausible privilege-escalation/account-takeover primitive rather than a cosmetic XSS. Mitigating factors are that the attacker must already hold canStream permission (PR:L) and a victim must actually view the malicious page (UI:P/required), so it is not a zero-interaction unauthenticated compromise. No EPSS score, KEV listing, or public exploit code was provided, so exploitation should be treated as feasible-but-not-yet-observed; any operator running a multi-user AVideo instance where streaming accounts are less trusted than admins should prioritize patching.

An attacker obtains or is granted a canStream account and creates a live link whose title or description contains a script payload. When an administrator or other viewer opens that live-link page, the script runs in their authenticated session within the site origin, letting the attacker steal session tokens or perform admin actions on the victim's behalf.