CVE-2026-89255
AVideo’s LoginControl plugin has a stored cross‑site scripting flaw that lets an attacker inject JavaScript into a public key field. The malicious code runs in an administrator’s browser when the admin views a user’s profile. The vulnerability is critical because it can be exploited by authenticated users to run arbitrary scripts in privileged sessions.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
The LoginControl plugin of the AVideo platform (no specific version listed).
Real-world impact
An attacker who can log in to the system can submit a crafted public key that contains JavaScript. When an administrator views the affected user’s profile, the script runs in the admin’s browser, potentially allowing the attacker to hijack the admin session, steal credentials, or perform other malicious actions.
Why this severity
The CVSS score of 9.3 reflects the combination of a low attack complexity, the need for authentication, and the high impact on confidentiality, integrity, and availability. The vulnerability allows an attacker to execute arbitrary code in an administrator’s session, which is a severe security risk.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources