AVideo Meet EUVD-2026-42270

Q: What is the CVSS score of EUVD-2026-42270?

EUVD-2026-42270 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-60092 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-08 disclosure@vulncheck.com

GHSA-4f8v-jp98-cpv3

PHP XSS

5.1

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.1 MEDIUM

Unauthenticated network injection via public meeting join (PR:N, AV:N) with scope change into privileged admin session (S:C); low C/I typical of XSS, no availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 08, 2026 - 15:21 vuln.today

DescriptionCVE.org

AVideo (Meet plugin) through commit e8d6119f3cb1b849149906efeb0a41fc024f59f8 contains a stored cross-site scripting vulnerability in the Meet plugin's getMeetInfo.json.php endpoint. When a participant joins a public meeting, the raw HTTP User-Agent header is stored (meet_join_log.user_agent) without sanitization (bypassing AVideo's setter-level xss_esc() layer) and later echoed without output encoding (no htmlspecialchars()) in the Participants management panel, which is accessible to the meeting host and site administrators. An anonymous, unauthenticated attacker can join any public meeting while supplying a User-Agent header containing an HTML/JavaScript payload; the payload is persisted and executes in the privileged, authenticated browser session of the meeting host or a site administrator when they open the participant list. The issue was unpatched at the time of the report.

AnalysisAI

Stored XSS in AVideo's Meet plugin allows an anonymous, unauthenticated attacker to inject arbitrary JavaScript into privileged administrator and host browser sessions by supplying a malicious HTTP User-Agent header when joining any public meeting. The getMeetInfo.json.php endpoint persists the raw User-Agent value in meet_join_log.user_agent, bypassing AVideo's xss_esc() setter and omitting htmlspecialchars() at the output layer in the Participants management panel, where it renders in authenticated host and admin sessions. No vendor patch was available at the time of disclosure; no public exploit code or CISA KEV listing has been identified.

Technical ContextAI

AVideo is an open-source PHP video streaming and conferencing platform; the Meet plugin extends it with video conferencing capabilities. The vulnerable endpoint getMeetInfo.json.php processes meeting join requests and logs participant metadata - including the raw HTTP User-Agent string - into the meet_join_log.user_agent database column. AVideo implements an xss_esc() sanitization helper at the model setter layer, but this call is bypassed for the User-Agent field, writing unsanitized HTTP header content directly to the database. The Participants management panel, accessible to meeting hosts and site administrators, later retrieves and renders the stored User-Agent without any htmlspecialchars() or equivalent output encoding, completing a classic stored XSS source-to-sink chain. CWE-79 (Improper Neutralization of Input During Web Page Generation) is the accurate root cause classification: the failure occurs at the output encoding layer rather than solely at input validation, and the dual bypass - missing setter sanitization AND missing output encoding - makes this particularly clean to exploit. The affected codebase is confirmed through commit e8d6119f3cb1b849149906efeb0a41fc024f59f8 in the WWBN/AVideo GitHub repository.

Affected ProductsAI

AVideo with the Meet plugin installed is confirmed affected through and including commit e8d6119f3cb1b849149906efeb0a41fc024f59f8 of the WWBN/AVideo GitHub repository. No discrete version numbers or CPE strings are provided in the available intelligence data; the affected range is defined by git history up to the referenced commit. Any AVideo deployment that has the Meet plugin active and exposes public meetings (joinable without authentication) is at risk. The GitHub security advisory GHSA-7cqp-7cfv-6c3q at https://github.com/WWBN/AVideo/security/advisories/GHSA-7cqp-7cfv-6c3q is the authoritative vendor reference for affected scope.

RemediationAI

No vendor-released patch has been identified at time of this report; the issue was explicitly unpatched at disclosure. Operators should monitor the GitHub security advisory at https://github.com/WWBN/AVideo/security/advisories/GHSA-7cqp-7cfv-6c3q and the VulnCheck advisory at https://www.vulncheck.com/advisories/avideo-stored-cross-site-scripting-via-unescaped-user-agent-in-participants-panel for patch availability. The most effective immediate compensating control is to disable public meeting join functionality or require authenticated accounts for all meeting participation, which eliminates the unauthenticated injection vector entirely - note this limits meeting accessibility for anonymous guests. A secondary control is to restrict the Participants management panel to an administrative network segment or VPN, so that even if a payload is stored it cannot execute in an exposed session. A code-level workaround involves wrapping the user_agent output variable in htmlspecialchars() within the Participants panel template; this must be reapplied after any upstream update and should also add xss_esc() at the setter for meet_join_log.user_agent to enforce defense in depth. Removing or auditing any stored entries in meet_join_log.user_agent for active payloads is also advisable for already-exposed deployments.