AVideo CVE-2026-89255

Requires an authenticated account on the target AVideo instance (PR:L) with access to the LoginControl plugin's PGP public key submission field, and the LoginControl plugin must be enabled. Exploitation is gated by passive user interaction: an administrator must view the attacker's user profile tab for the stored payload to execute (UI:P). It limits to instances running a build at or before commit c3edcc274c389816d434acadac07ee78eaf330c1 with the vulnerable PGP-key textarea rendering. Not exploitable pre-authentication and not automatable to fire without the admin's profile view.

The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N, score 9.3) reflects network reach, low complexity, but crucially requires attacker authentication (PR:L) and passive victim interaction (UI:P) - an administrator must view the malicious profile for the payload to fire. This is a targeted, interaction-gated attack rather than a mass-exploitable RCE, which tempers the high headline score. No EPSS value, KEV listing, or public POC is provided; exploitation status is 'no public exploit identified at time of analysis.' Real-world priority is moderate-to-high for any AVideo deployment that grants self-service accounts, because successful exploitation yields admin-session compromise, but it depends entirely on an admin visiting the attacker's profile.

An attacker registers or uses an existing low-privilege AVideo account and submits a PGP public key containing a payload such as </textarea><script>…</script> via the LoginControl plugin. The script lies dormant until an administrator opens the attacker's profile tab, at which point it executes in the admin's authenticated session - allowing session-token theft, forced admin actions, or account takeover. No public POC is noted, but the injection is straightforward given the described unencoded textarea sink.