External risk intelligence

WWBN AVideo Stored Cross-Site Scripting via Video Download Link

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-126806

WWBN AVideo is a web-based video platform commonly deployed as a public-facing web application. Since the vulnerability resides within the application's video management and rendering components, which are typically accessible via the web interface to allow user content interaction, it is likely to be reachable in standard web deployments.

Cross-site Scripting

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a stored cross-site scripting vulnerability found in WWBN AVideo. This issue allows an attacker to inject malicious scripts into the application, which could then be executed within administrator sessions, potentially leading to unauthorized plugin installations. The main concern at this stage is confirming if this specific technology is in use and to what extent it may be exposed.

Injects scripts via video links.
Attackers can take over admin sessions.
Confirm use and exposure of this platform.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by uploading a video with a specially crafted URL. This URL, when rendered by the application, would execute malicious scripts within the administrator's browser. These scripts could then be used to install unauthorized plugins containing PHP code, potentially leading to further compromise.

Attacker uploads malicious video URL.
Admin views the video management page.
Arbitrary plugin installation risk.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, administrators running WWBN AVideo could be at risk of having plugins installed on their systems. This occurs when an uploader crafts a malicious URL containing script payloads, which are then executed within an administrator's session when their video links are rendered. The consequence of this could be the installation of unauthorized PHP plugins.

Administrator sessions and system integrity.
Scripts injected via video link URLs.
Unauthorized plugin installation.

Operational Fix

Recommended remediation, mitigation, and detection steps

The technical leader for WWBN AVideo, likely an application owner or platform team, should initiate an inventory of all AVideo instances. Once identified, confirm each instance's reachability, business criticality, and the specific owner accountable for its maintenance and security before planning remediation.

Application owners, platform teams.
Verify instance reachability and criticality.
Plan remediation or apply vendor fixes.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is WWBN AVideo?

WWBN AVideo is an open-source, web-based video platform used to host and stream video content. It functions as a content management system that allows users to upload, process, and manage media libraries. The platform includes specialized tools, such as encoders and management interfaces, which help administrators organize video assets and automate various processing tasks across their deployments.

What is the vulnerability in CVE-2026-126806?

This CVE describes a stored cross-site scripting (XSS) vulnerability, classified as CWE-79. It occurs because the application fails to properly sanitize the videoDownloadedLink value before saving it to a configuration file. Because the input is stored unescaped, the system later renders this malicious data as part of a webpage, causing the browser to execute unintended code when viewed by an administrator.

How does an attacker trigger this vulnerability?

An attacker initiates the vulnerability by uploading a video with a specially crafted URL containing a malicious script payload. The bug is triggered when an administrator accesses the video management dashboard and the application renders that saved URL within the browser. Simply uploading the content is not enough; the malicious script only executes if an administrator visits the specific management page where the video data is displayed.

Do I need to worry if my AVideo instance is internal?

According to Halo Surface Signal, WWBN AVideo is typically deployed as a public-facing web application, making instances accessible over the internet more likely to be reached by attackers. However, any instance—internal or external—could be vulnerable if an attacker gains the permissions necessary to upload content. You should prioritize assessing instances that are reachable by untrusted users.

What should I do if I run WWBN AVideo?

Your first step is to conduct an inventory to identify every instance of AVideo running in your environment. Once you have a complete list, verify the network accessibility and business criticality of each instance. Coordinate with the designated platform owners to document these systems and prepare to apply patches or updates as soon as they become available to mitigate the risk of unauthorized plugin installation.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.