WWBN AVideo CVE-2026-89239

The attack requires that a victim navigate to a vulnerable AVideo page directly from an attacker-controlled origin, so the browser sends an attacker-crafted Referer header. The victim does not need to be authenticated - however, impact is substantially higher against authenticated sessions (admin, uploader roles) where JavaScript execution enables session hijacking. The vulnerable code path must be reachable via a normal GET request to the AVideo endpoint that invokes showAlertMessage(). No special server configuration is required beyond running an unpatched AVideo instance. Exploitation is limited by the social engineering requirement: the victim must click a link or be redirected from the attacker's page, as modern browsers do not send Referer headers across direct address-bar navigation. Same-origin and secure contexts (HTTPS → HTTPS) impose standard browser Referer-Policy constraints, which may suppress or truncate the header in some configurations, further narrowing the effective attack surface.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N) scores 5.3, reflecting the medium-severity realistic impact: no privileges required for the attacker (PR:N), but passive user interaction is required (UI:P - victim must navigate from attacker's page). The SC:L/SI:L downstream impact acknowledges that script execution in the AVideo origin can affect the user's session and data integrity within that application, but is bounded in scope. No public exploit code has been identified at time of analysis, and no CISA KEV listing is present. EPSS data is not supplied. The real-world risk is meaningful for AVideo deployments that serve authenticated users with sessions worth hijacking (admins, content creators), but the social engineering prerequisite - inducing victims to click links from attacker-controlled pages - limits opportunistic mass exploitation. This is a prioritize-and-patch rather than emergency-response scenario.

An attacker creates a webpage at their controlled domain that either embeds a link or issues a redirect to a target AVideo installation's endpoint where showAlertMessage() is triggered, with the Referer header crafted to contain */ alert(document.cookie) /* . When a logged-in AVideo user visits the attacker's page and follows the link (or is automatically redirected), the browser sends the malicious Referer header; the AVideo server reflects it unencoded into the page's JavaScript, the comment is broken, and the injected script executes, exfiltrating the session cookie to an attacker-controlled server. No POC has been publicly released at time of analysis, but the attack primitive is straightforward for any developer familiar with HTTP header manipulation.