Reflected XSS in AVideo via Unsanitized Referer Header

Executive Summary

CVE-2026-89239 is a reflected cross-site scripting (XSS) vulnerability in WWBN AVideo. It occurs in the showAlertMessage() function where the raw Referer header is inserted into a JavaScript comment without proper encoding. Attackers can craft a Referer header containing */ to close the comment and inject arbitrary JavaScript that executes in the site's origin for visitors arriving from the attacker-controlled page.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor HTTP requests for Referer headers containing the string */. Check web server logs for unusual JavaScript injection attempts in Referer fields. Use tools like Burp Suite or OWASP ZAP to intercept and inspect Referer headers for payload patterns. Inspect JavaScript comments in pages using the showAlertMessage() function for improperly encoded Referer data.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to run malicious scripts in the context of the affected website for users visiting from the attacker's URL. This includes administrators, potentially leading to session hijacking, data theft, or unauthorized actions on the site. User interaction is required as the attacker must craft a URL with a Referer containing */ and use referrerpolicy="unsafe-url".

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update to the latest version of AVideo if available. If no patch exists, disable the showAlertMessage() function or sanitize Referer headers by encoding special characters. Implement a web application firewall (WAF) to block requests with Referer headers containing */. Restrict the use of referrerpolicy="unsafe-url" in your site's HTML.

Useful 0 Not Useful 0