Description

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LoginControl plugin that fails to HTML-encode PGP public keys echoed into a textarea element. An authenticated attacker can inject malicious JavaScript by submitting a crafted public key, which executes in an administrator's session when viewing the user's profile tab.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.7",
  "pubDate": "2026-09-11T12:16:55.850Z",
  "pubdate": "2026-09-11T12:16:55.850Z",
  "executiveSummary": "This vulnerability is a stored cross-site scripting (XSS) flaw identified in the LoginControl plugin of AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1). The vulnerability arises due to the application's failure to perform adequate input sanitization or output encoding on PGP public key data before rendering it within an HTML textarea element.\nAn authenticated attacker can exploit this flaw by submitting a crafted PGP public key containing malicious JavaScript. When an administrator subsequently views the affected user's profile tab, the script executes within the context of the administrator's session. This allows for unauthorized actions, session hijacking, or data exfiltration. The risk is significant as it facilitates administrative compromise via a stored payload, requiring only standard user authentication to initiate the attack vector.",
  "technicalDetails": "The vulnerability exists within the LoginControl plugin of the AVideo platform. The root cause is an improper neutralization of user-supplied data during the rendering process. Specifically, the application accepts a PGP public key input from a user and stores it in the database. When the profile page is loaded, the application retrieves this raw input and echoes it directly into the value attribute of an HTML textarea element without applying mandatory HTML entity encoding.\nThe exploitation flow begins with an authenticated attacker navigating to the user profile management interface where PGP keys are processed. The attacker submits a specially crafted string designed to break out of the textarea context, such as '</textarea><script>alert(document.cookie)</script>'. Because the input is stored persistently in the database, the payload remains dormant until the affected record is accessed by a higher-privileged user.\nThe vulnerability reaches the exploitation phase when an administrator logs into the system and accesses the profile tab associated with the attacker's account. The application fetches the malicious string from the database and renders the HTML. The browser interprets the injected tags as legitimate executable code rather than plain text data within the textarea, resulting in the execution of the JavaScript payload within the administrator's security context.\nThe payload executes in the domain of the AVideo installation, granting the script full access to the Document Object Model (DOM), browser storage (cookies, local storage), and the ability to perform background HTTP requests using the administrator's authenticated session tokens. This enables post-exploitation activities such as privilege escalation, unauthorized modification of system settings, or the creation of backdoored accounts.\nThe affected component is the profile management module within the LoginControl plugin. Any version of AVideo up to commit c3edcc274c389816d434acadac07ee78eaf330c1 is considered vulnerable. As the application fails to enforce server-side output escaping, client-side input validation is insufficient to mitigate the risk. The vulnerability requires the attacker to have an active, authenticated user account, but it does not require administrative privileges, making it a viable path for lateral movement and privilege escalation by any registered user."
}