Description

AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php that allows unauthenticated attackers to inject arbitrary JavaScript by closing the script tag with </script>. Attackers can craft a malicious URL with an error parameter containing script breakout sequences to execute arbitrary JavaScript in the victim's browser context on the login page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-04T12:17:19.500Z",
  "pubdate": "2026-09-04T12:17:19.500Z",
  "executiveSummary": "AVideo through commit c91b5975d is susceptible to a reflected cross-site scripting (XSS) vulnerability located in the userLogin.php component. This security flaw allows unauthenticated remote attackers to execute arbitrary JavaScript in the context of a victim's browser session by injecting malicious payloads via the error parameter.\nThe vulnerability arises from improper validation and sanitization of user-supplied input before rendering it directly into the HTML response. By crafting a specific URL containing script-breaking sequences, an attacker can manipulate the Document Object Model (DOM) to execute unauthorized code. Successful exploitation permits the execution of malicious scripts, which can lead to session hijacking, credential theft, unauthorized actions on behalf of the user, or redirection to malicious third-party websites.\nGiven that the attack does not require prior authentication and can be executed via a crafted URL, the risk to the platform is significant. It poses a substantial threat to users who may be induced to interact with malicious links, potentially compromising their accounts or system integrity through client-side script execution.",
  "technicalDetails": "The vulnerability exists within the userLogin.php file, which fails to adequately sanitize input provided through the 'error' parameter. The application reflects the content of this parameter directly into the page source without applying context-aware encoding or robust filtering. This lack of input sanitization allows for the injection of arbitrary HTML and JavaScript tags.\nThe primary mechanism of exploitation involves the attacker closing an existing script tag context or injecting a new one to facilitate cross-site scripting. Specifically, the attacker provides a malicious payload containing a closing </script> tag followed by the desired JavaScript logic. When the victim accesses the crafted URL, the server includes the attacker-supplied payload within the HTML response. The browser interprets the modified content as legitimate executable code, leading to the execution of the injected script within the security origin of the AVideo application.\nThe attack flow is as follows: 1) The attacker identifies the vulnerable userLogin.php script and its reliance on the 'error' parameter for user feedback. 2) The attacker constructs a URL containing a payload designed to break out of the intended HTML context—typically using sequences like '</script><script>alert(1)</script>'. 3) The attacker distributes this malicious URL to a target user, often via social engineering or embedded links. 4) Upon the user clicking the link, the victim's browser sends a GET request to the AVideo server with the malicious payload in the 'error' parameter. 5) The server processes the request and returns an HTTP response containing the injected script in the clear. 6) The victim's browser executes the script in the context of the AVideo session, enabling unauthorized actions, theft of session cookies (if not protected by the HttpOnly flag), or DOM-based attacks.\nThis vulnerability affects all AVideo versions through commit c91b5975d. It is a classic example of reflected XSS where the reflection point is poorly protected against common cross-site scripting breakout vectors. Because the application fails to utilize appropriate output encoding methods (such as converting characters like '<', '>', and '/' into their corresponding HTML entities), it remains fully exposed to these injection techniques. The exposure is categorized as unauthenticated, meaning any remote actor can trigger the flaw provided they can reach the login endpoint."
}