CVE-2026-89256

AVideo, an open-source self-hosted video streaming platform, contains a stored cross-site scripting (XSS) flaw in its Bookmark plugin, rated critical at 9.3 under CVSS 4.0. The plugin concatenates chapter (bookmark) names into the public watch-page HTML without encoding them, so a video owner can submit a bookmark name containing script markup that is stored and later served to anyone viewing that video. The injected script then runs in every visitor's browser within the AVideo origin, letting the attacker steal sessions or cookies, impersonate users, and act as any viewer, including potentially privileged accounts. Any AVideo deployment up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1 with publicly accessible watch pages and bookmark creation enabled is affected. No public proof-of-concept exists, the flaw is not in CISA's Known Exploited Vulnerabilities catalog, and no in-the-wild exploitation is known at this time.

What to do: Update AVideo to a revision newer than commit c3edcc274c389816d434acadac07ee78eaf330c1, which encodes bookmark/chapter names before they are rendered on watch pages. Until patched, restrict bookmark creation to trusted accounts and audit existing bookmark names for embedded HTML or script payloads. Admins should also confirm whether their watch pages are publicly reachable, since any visitor executes a stored payload.