CVE-2026-89255 - AVideo LoginControl Stored XSS via PGP Public Key

Back Back to CVE browser

CRITICAL

AVideo LoginControl Stored XSS via PGP Public Key

Published Sep 11, 2026

9.3

CRITICAL

CVSS 4.0

EPSS 0.37%

Description

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LoginControl plugin that fails to HTML-encode PGP public keys echoed into a textarea element. An authenticated attacker can inject malicious JavaScript by submitting a crafted public key, which executes in an administrator's session when viewing the user's profile tab.

Affected products

Vendor WWBN Product AVideo Default
unaffected
- Version
  0
  Status
  affected
  Constraints

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

WWBN

AVideo

unaffected

Version	Status	Constraints
0	affected

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-76067
Advisory
https://github.com/WWBN/AVideo/security/advisories/GHSA-gq4h-vw2w-9rx3
exploitvendor-advisory
https://www.vulncheck.com/advisories/avideo-logincontrol-stored-xss-via-pgp-public-key
third-party-advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-76067		Advisory
https://github.com/WWBN/AVideo/security/advisories/GHSA-gq4h-vw2w-9rx3		exploitvendor-advisory
https://www.vulncheck.com/advisories/avideo-logincontrol-stored-xss-via-pgp-public-key		third-party-advisory