AVideo CVE-2026-89256

Requires an authenticated low-privilege account that can own/upload a video and create a bookmark (PR:L), the target instance must have the Bookmark plugin enabled, and a victim must load the affected video's public watch page (UI:P) for the payload to fire. Exploitation is limited by these factors: it cannot be performed by a fully unauthenticated outsider, it does not trigger without victim interaction (viewing the video), and it depends on the Bookmark plugin being active - instances that disable it are not exposed.

The CVSS 4.0 base score of 9.3 (AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/SC:H/SI:H) is high, but it appears inflated for a stored XSS: it rates both confidentiality and integrity as High on the vulnerable and subsequent systems, whereas the realistic impact is theft of session tokens/CSRF-able actions in the browser context (typically Low-to-High depending on what an admin session exposes), not direct high-integrity compromise of the server. Attack complexity is genuinely low and the network vector is real, but two meaningful limiters apply: the attacker must already hold a low-privilege account able to own/upload a video and create bookmarks (PR:L), and a victim must visit the malicious video's watch page (UI:P/UI:R). There is no CISA KEV entry and no EPSS figure supplied, and while a VulnCheck advisory and a GitHub Security Advisory exist, no packaged exploit code was identified - so this is a credible but not mass-exploited issue best prioritized by operators running multi-user AVideo instances where untrusted users can publish videos.

An attacker registers or obtains a low-privilege AVideo account with upload rights, publishes a video, and sets a bookmark/chapter name containing a script payload such as an image-onerror or inline script tag. When any user - including a logged-in administrator browsing the site - opens that video's public watch page, the stored payload executes in the AVideo origin, allowing session-cookie theft, forced admin actions, or drive-by manipulation. Advisory-level detail from VulnCheck and WWBN makes reproduction straightforward even though no packaged exploit tool was identified.