WWBN AVideo CVE-2026-89241

Exploitation requires that the victim click or be redirected to a specifically crafted URL targeting the confirmLivePassword.php endpoint on an AVideo instance accessible over the network. No authentication, special privileges, or non-default configuration is required on the attacker's side. The sole limiting factor is passive victim interaction (UI:P in CVSS 4.0): the victim must load the malicious URL in a browser - a condition typically satisfied via phishing, open redirect chains, or embedded links. The vulnerability is present in any AVideo deployment exposing this PHP file over HTTP or HTTPS. Exploitation is constrained to the victim's browser session and the AVideo site origin; server-side code execution is not possible via this vector.

The CVSS 4.0 vector scores this at 5.3 (Medium), capturing the core trade-off: zero authentication or special configuration required (PR:N, AC:L), but victim interaction is mandatory (UI:P), and the confidentiality and integrity impacts are limited (VC:L/VI:L). This is a realistic, low-friction social-engineering phishing vector - a single crafted URL delivered via email, messaging, or a redirect chain suffices. No CISA KEV listing exists and no POC code is explicitly referenced in the available intelligence, though the GitHub security advisory and VulnCheck report provide sufficient detail for reproduction by a skilled attacker. EPSS data is absent from the input. Reflected XSS on a login-adjacent page (confirmLivePassword.php) is particularly sensitive because victims landing there may already be authenticated or in the process of authenticating, making session theft via document.cookie a realistic secondary impact if the session cookie is not HttpOnly. The SC:L/SI:L in the 4.0 vector acknowledges downstream trust-chain risk. This is a genuine medium-priority remediation item for any publicly exposed AVideo instance.

An attacker sends a phishing link to an AVideo user - for example, a URL to confirmLivePassword.php with a crafted path segment containing a double-quote followed by an injected event handler. When the victim loads the page, the unencoded REQUEST_URI lands in the form action attribute, the quote breaks attribute context, and the event handler fires executing attacker-controlled JavaScript in the victim's browser. No public POC code is referenced in the available data, though the advisory description provides sufficient technical detail for reproduction.