AVideo-Encoder EUVD-2026-112511

Exploitation requires an attacker to deliver a crafted AVideo-Encoder login URL and a victim operator to open it (UI:R). The concrete injection points are the webSiteRootURL parameter (returned verbatim by Streamer::getStreamerURL(), absent from every objects/security.php filter list, reflected into the navbar href, a form value, and a single-quoted inline JavaScript string in view/index.header.php), the user and pass POST fields (sanitized only by stripping single quotes, so double quotes and angle brackets still break out of their HTML attributes in view/index.php), and the lang POST field (stored in the session by locale/function.php and re-reflected in view/index.php). These affect the default anonymous login interface - no special configuration is needed because the login view renders for any unauthenticated visitor (the gate checks only Login::canUpload()). Limiting factors: the attack depends on social engineering of a victim, and the highest-value impact (reading the operator session identifier exposed in inline script and acting as the operator) requires the victim to be an authenticated operator whose session is rendered. Versions prior to 8.1.0 are affected.

This is a moderate-severity reflected XSS (CWE-79) with a self-consistent set of signals rather than conflicting ones. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, base 6.1) describes a network-reachable, unauthenticated, low-complexity flaw that nonetheless requires victim interaction (UI:R) - the attacker cannot act alone, they must persuade an operator to open a crafted login link. The scope change (S:C) is appropriate because injected script executes in the encoder's origin and can reach the upstream AVideo platform. No EPSS score and no SSVC automatable/technical-impact breakdown were supplied, so probabilistic and decision-tree signals are absent; the only priority signal is the vuln.today Decision label 'this_month', which is below act_now/emergency and consistent with a UI-gated XSS rather than a wormable server flaw. The CVE is NOT in CISA KEV, so there is no evidence of active exploitation. A detailed public PoC is present in the GitHub Security Advisory. Overall this is a genuine but not emergency issue: real impact (operator session/credential theft) is possible, but exploitation depends on social engineering of a privileged user, and the product footprint is small. Prioritize patching within the vendor-suggested window rather than treating it as an actively exploited emergency.

An attacker crafts a login URL for a target AVideo-Encoder instance with a malicious payload in the webSiteRootURL, user, pass, or lang parameter and sends it to an operator (e.g. via email or chat). Because AC:L and the anonymous login page renders for any visitor, the only barrier is UI:R - the operator must open the link. The GHSA advisory includes working curl reproduction steps and a headless-Chromium confirmation, so a public PoC exists; when the operator loads the link, injected JavaScript runs in the encoder origin and can exfiltrate the inline-rendered PHPSESSID and typed credentials.