CVE-2026-88866
WWBN AVideo’s LoginControl plugin stores the User‑Agent header in login history without encoding it, letting anyone with a valid account inject JavaScript that runs when an administrator views the history page.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
WWBN AVideo (LoginControl plugin) – any installation that uses the LoginHistory feature.
Real-world impact
An attacker can run arbitrary JavaScript in an administrator’s browser, potentially hijacking the admin session, stealing credentials, or modifying site content.
Why this severity
The CVSS score is high because the flaw allows a low‑effort attacker with a valid account to execute scripts with high impact on confidentiality, integrity, and availability of the administrator session.
What to do about it
- ›Avoid using the Login History page until a patch is released.
- ›Use a safe User‑Agent header that does not contain malicious scripts.
- ›If possible, disable the Login History feature to prevent the stored XSS.
- ›Ensure administrator browsers are not exposed to untrusted User‑Agent headers.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources