External risk intelligence

AVideo Donation Link Stored Cross-Site Scripting

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-89253

The vulnerability exists in AVideo, a platform designed for hosting and viewing videos. As a web application intended to be accessible to visitors for watching content, it is commonly deployed as an internet-facing service. The vulnerable donation link feature is exposed on the public-facing watch page, making it reachable by any user interacting with the platform.

Cross-site Scripting

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability has been identified in the WWBN AVideo platform, specifically related to how user-provided donation links are handled. This issue allows authenticated users to inject malicious code that could execute within the browsers of visitors viewing their content, potentially impacting administrators as well. The main concern is confirming if this specific platform is in use and if the affected feature is enabled.

User profile links can be manipulated.
Affects how visitors interact with content.
Confirm relevance and exposure of the platform.

Attack Path

How an attacker could exploit the issue

An authenticated user can inject malicious JavaScript into their profile's donation link, which is then displayed on video watch pages. When a visitor views the page and interacts with the donation button, the injected script executes in their browser, potentially impacting them even if they are an administrator.

Attacker needs an account and profile access.
User views a video with a malicious donation link.
Arbitrary JavaScript execution in visitor browsers.

Live Threat

Current exploitation, exposure, and threat context

This stored cross-site scripting vulnerability could allow an authenticated user to inject JavaScript into the donation button on the watch page. This script could execute in the browser of any visitor, including administrators, when they interact with the button. The advisory does not specify if PII or other sensitive data types are at risk.

User profile data could be exposed.
Malicious JavaScript could execute in a visitor's browser.
Site visitors could be subject to unwanted actions.

Operational Fix

Recommended remediation, mitigation, and detection steps

This stored cross-site scripting vulnerability in WWBN AVideo likely falls under the responsibility of the application or platform team managing the AVideo instance, with oversight from the security team for exposure assessment and remediation planning. The initial step is to inventory all AVideo deployments, identify instances where the 'donationLink' feature is enabled and user-configurable, and confirm their business criticality and network reachability. Coordination with the vendor for a confirmed fix or guidance on applying mitigating configurations will be necessary.

Application or platform owners.
Verify 'donationLink' feature enabled, user-configurable.
Plan remediation, coordinate with vendor for fix.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is WWBN AVideo?

WWBN AVideo is an open-source web application designed to function as a video-sharing and hosting platform. It provides features for users to upload, manage, and watch media content. The software includes social features, such as donation links on user profiles, which allow creators to receive support from their viewers.

How does CVE-2026-89253 allow malicious script execution?

This vulnerability is a stored cross-site scripting (XSS) flaw, categorized as CWE-79. It occurs because the application fails to properly sanitize or encode user-supplied text in the donation link profile field. When this data is displayed on a page, the browser interprets the malicious input as active code instead of plain text, allowing it to execute within the session of anyone viewing the button.

Do I need to be an administrator for this to trigger?

No, an administrator is not required to trigger this vulnerability. Any authenticated user can input the malicious payload into their own profile. However, the script only executes when a visitor—which could include an administrator—views that specific user's video page and interacts with the compromised donation button.

Is my AVideo instance at risk if it is internal only?

While internal instances have a smaller audience, Halo Surface Signal notes that AVideo is typically deployed as an internet-facing service for public viewing. If your instance is reachable by users you do not fully trust, they could exploit this to target other internal users or administrators who browse the site. The risk depends on who has account access and the trust level of those users.

How should I respond to this security advisory?

Begin by inventorying your AVideo deployments to confirm if you are running an affected version. Check if the 'CustomizeUser' plugin and the 'allowDonationLink' option are currently enabled, as these are required for the vulnerability to exist. If enabled, restrict user access to profile settings or disable the donation feature until you can coordinate with the vendor to obtain a secure update.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.