Description

AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php where the cancelUri parameter is echoed in an href attribute after isSafeRedirectURL checks protocol only, not HTML characters. Unauthenticated attackers can inject event handlers via relative URLs with embedded quotes to execute arbitrary JavaScript when users interact with the Cancel button.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-03T13:06:22.820Z",
  "pubdate": "2026-09-03T13:06:22.820Z",
  "executiveSummary": "This vulnerability involves a Reflected Cross-Site Scripting (XSS) flaw in AVideo, impacting all versions up to commit c91b5975d.\nThe issue resides in the userLogin.php component, where the cancelUri parameter is improperly handled before being rendered in the Document Object Model (DOM).\nAn unauthenticated attacker can exploit this flaw to execute arbitrary JavaScript within the context of the victim's session.\nSuccessful exploitation allows for potential session hijacking, unauthorized actions performed on behalf of the user, and theft of sensitive information.\nThe vulnerability arises due to a failure in input sanitization, specifically where security controls only validate protocols without neutralizing dangerous HTML meta-characters.\nThis vulnerability is classified as critical due to the ease of exploitation, as it only requires the victim to interact with a crafted link or element, such as the Cancel button, after the payload is injected.",
  "technicalDetails": "The root cause of this Reflected Cross-Site Scripting (XSS) vulnerability is insufficient input validation and output encoding within userLogin.php in AVideo up to commit c91b5975d.\nSpecifically, the application utilizes a function named isSafeRedirectURL to validate the cancelUri parameter provided via GET or POST requests.\nAnalysis indicates that isSafeRedirectURL performs a protocol-based check to verify if the redirect target is legitimate, but it fails to perform context-aware encoding or character filtering to neutralize HTML meta-characters such as double quotes (\") or single quotes (').\nBecause the application reflects the unvalidated cancelUri directly into the href attribute of an anchor tag, an attacker can break out of the attribute context.\nThe attack flow begins when an unauthenticated attacker crafts a malicious URL containing a relative path designed to escape the href attribute. For example, by injecting a payload such as '\" onmouseover=\"alert(1)\", the attacker can successfully close the href attribute and inject an arbitrary event handler like onmouseover or onclick into the tag.\nWhen a victim visits the crafted URL, the malicious payload is reflected in the generated HTML source of userLogin.php. The browser interprets the injected event handler as legitimate code associated with the 'Cancel' button element.\nExploitation occurs the moment the user interacts with the compromised UI element. The JavaScript payload executes in the security context of the victim's current session, providing the attacker with the ability to perform cross-site request forgery (CSRF), manipulate the DOM, or exfiltrate session cookies if they are not protected by the HttpOnly flag.\nThe vulnerability is exposed over the network, does not require authentication, and necessitates no specific privilege level to trigger. It represents a significant risk to the integrity and confidentiality of the AVideo platform's user sessions."
}