CVE-2026-88868

AVideo, an open-source video streaming platform, contains a stored cross-site scripting (XSS) vulnerability in its LiveLinks plugin, where live-link title and description fields are saved without sanitization. A user holding the canStream permission can inject malicious JavaScript into those fields, and the script then executes in the browser of every visitor who opens the affected live-link page, including administrators, within the site origin. Because the payload fires against any viewer, an attacker could hijack sessions or perform actions as the victim (including admin users) within the site origin, consistent with the high confidentiality and integrity impacts in the CVSS 4.0 vector. All AVideo deployments running code through commit c3edcc274c389816d434acadac07ee78eaf330c1 with the LiveLinks plugin enabled are affected. No public proof-of-concept or in-the-wild exploitation is known, and the issue is not listed in CISA's KEV.

What to do: Deploy an AVideo build newer than commit c3edcc274c389816d434acadac07ee78eaf330c1 once the patched release is available, and as an interim measure restrict the canStream permission to fully trusted users. Audit existing LiveLinks title and description values for injected HTML or JavaScript and remove any suspicious content. Administrators should avoid casually browsing live-link pages until patched, since their sessions are the most valuable target.