Unauthenticated Reflected XSS in WWBN AVideo

Executive Summary

CVE-2026-82646 is an unauthenticated reflected cross-site scripting (XSS) vulnerability in WWBN AVideo's url2Embed.json.php endpoint. Attackers can inject malicious scripts by providing URLs with HTML metacharacters. The system creates an encrypted payload containing unescaped markup, which appears as a legitimate link on the same domain. When clicked, it executes JavaScript in victims' sessions to steal cookies or CSRF tokens.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect network traffic for requests to the url2Embed.json.php endpoint with URLs containing HTML metacharacters like <, >, or ". Use tools like curl to test the endpoint: curl 'http://target.com/url2Embed.json.php?url=https://x.com/a"><script>alert(1)</script>'. If the response reflects the script without proper escaping, the vulnerability likely exists.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to execute arbitrary JavaScript in your browser session when you click a malicious link. This could lead to theft of session cookies, CSRF tokens, or sensitive data. Attackers might also perform actions on your behalf, such as changing account settings or making unauthorized requests.

Useful 0 Not Useful 0

Compliance Impact

This XSS vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. It may result in data breaches, unauthorized data access, or loss of data integrity, potentially leading to regulatory penalties and compliance violations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update AVideo to the latest patched version. If an update is unavailable, restrict access to the url2Embed.json.php endpoint via server configuration. Implement input validation to reject URLs with HTML metacharacters and ensure output escaping in the videoLink rendering process.

Useful 0 Not Useful 0