External risk intelligence

AVideo LiveLinks Plugin Stored Cross-Site Scripting Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-88868

AVideo is a video streaming and management platform typically deployed as a public-facing web application. Since the vulnerability exists in a LiveLinks plugin component that is intended to be accessed by visitors to the site, it is likely to be reachable via the internet in common real-world deployments.

Cross-site Scripting

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A stored cross-site scripting vulnerability exists within the LiveLinks plugin of the AVideo platform, allowing users with specific permissions to inject malicious scripts. These scripts can execute in the browsers of all visitors viewing the live-link page, potentially including administrators, thereby posing a broad risk to site integrity and user sessions.

AVideo plugin allows script injection.
It impacts all site visitors and admins.
Confirm relevance and exposure for your AVideo instance.

Attack Path

How an attacker could exploit the issue

An attacker with the ability to stream content can inject malicious scripts into the title or description fields of a live link. These scripts then execute in the browsers of all visitors, including administrators, who view the live-link page.

Publicly accessible, requires streaming permission.
Stored script executes on visitor access.
Cross-site scripting leading to site compromise.

Live Threat

Current exploitation, exposure, and threat context

A stored cross-site scripting vulnerability in the LiveLinks plugin could allow an authenticated user to inject malicious scripts. These scripts could execute in the browser of any visitor viewing a live-link page, including administrators, within the site's origin.

Site content and visitor sessions could be affected.
Malicious scripts execute in visitor browsers.
Unauthorized actions may occur within the site.

Operational Fix

Recommended remediation, mitigation, and detection steps

The AVideo platform's LiveLinks plugin requires immediate attention from application owners and security teams. The first practical step is to identify all AVideo deployments, verify their exposure and business criticality, and confirm the accountable owner for each instance. This will allow for risk-based remediation planning, potentially involving vendor coordination or temporary mitigations if immediate patching is not feasible.

Application owners must address this.
Verify plugin usage and reachability first.
Plan remediation based on confirmed exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is AVideo?

AVideo is an open-source software platform used for hosting, managing, and streaming video content. It functions as a web-based multimedia management system that allows users to upload, organize, and broadcast live or recorded video to audiences, often serving as a self-hosted alternative to major commercial streaming platforms.

How does CVE-2026-88868 work?

This vulnerability is a Stored Cross-Site Scripting (XSS) flaw, classified as CWE-79. It occurs because the LiveLinks plugin fails to sanitize user input in the title and description fields. When a user submits these fields, the malicious script is saved directly to the site's database. Because the application does not filter this data, the browser of anyone who views the live-link page will automatically execute the embedded script.

What triggers this vulnerability?

An attacker must have 'canStream' permissions to successfully inject a script into the LiveLinks plugin's fields. Simply browsing the site or viewing a standard video does not trigger the bug. The malicious code only executes when a visitor, including an administrator, opens the specific live-link page where the tainted title or description has been saved.

Is my AVideo instance at risk?

According to Halo Surface Signal, this vulnerability is likely reachable via the internet because AVideo is typically deployed as a public-facing streaming platform. If your instance is accessible to the public and the LiveLinks plugin is enabled, your users and administrators are at risk of script execution when they interact with affected pages.

What should I do to respond to this issue?

Start by identifying all AVideo installations in your environment and verifying if they have the LiveLinks plugin enabled. Once you have an inventory, assess which instances are exposed to the public internet versus those on internal networks. Coordinate with your application owners to prioritize these systems for remediation, while exploring vendor-provided updates or temporary configuration changes to limit access to the plugin.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.