WWBN AVideo CVE-2026-89247

Exploitation requires that the AD_Server plugin is explicitly installed and enabled on the target AVideo instance - this is a non-default, optional plugin and must be activated by an administrator. The attacker-controlled vmaps parameter must be base64/JSON-encoded and contain a non-empty VAST.campaing entry to trigger the code path that reads timeOffset and idTag. A victim must open the crafted VMAP URL directly or visit a video page referencing it (passive user interaction, UI:P); the victim does not need to take an active download or approval action, but must be induced to visit the URL. No authentication is required on the attacker side (PR:N). Exploitation is bounded to ad injection and attacker-controlled cross-origin requests from the victim's browser - no server-side code execution is possible through this vector. AVideo instances with the AD_Server plugin disabled, or not publicly accessible, are not exploitable.

The CVSS 4.0 score of 5.3 (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N) accurately reflects moderate severity. The unauthenticated network access (PR:N/AV:N) and absence of special attack requirements (AC:L/AT:N) lower the exploitation barrier, but the mandatory victim interaction (UI:P - victim must open a crafted URL or video page) significantly limits scalability and automated mass exploitation. Real-world impact is confined to ad injection and cross-origin requests from the victim browser to attacker-controlled ad infrastructure; there is no server-side code execution, despite the 'RCE' tag present in source metadata (which is not supported by the description or CVSS impact scores of C:L/I:L). The subsequent-system impacts (SC:L/SI:L) reflect cross-origin requests reaching attacker-controlled ad servers from the victim's session. No EPSS data is available for this CVE, no KEV listing exists, and no public exploit code has been identified. The non-default AD_Server plugin requirement further constrains the real-world exposed population to AVideo instances that have explicitly enabled this plugin. This is a genuine but moderate-priority issue for affected deployments, not an emergency.

An attacker identifies a publicly reachable AVideo instance with the AD_Server plugin enabled, then crafts a vmaps parameter containing base64/JSON-encoded VMAP data with injected <vmap:AdBreak> elements pointing to an attacker-controlled <vmap:AdTagURI>. The attacker delivers the resulting VMAP URL via phishing or embeds it in a webpage; when a victim loads the video player, the IMA client automatically fetches the injected ad tag URI, issuing cross-origin HTTP requests to the attacker's server and displaying injected advertisement content in the player. No public exploit code has been identified.