External risk intelligence

AVideo LoginControl Stored XSS via PGP Public Key

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-89255

AVideo is a web-based video sharing platform typically deployed as an internet-facing application. The vulnerability exists within a user-profile management feature, which is commonly accessible to users in standard web deployments of this software.

Cross-site Scripting

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A stored cross-site scripting vulnerability exists in the Login Control plugin for AVideo, allowing an authenticated attacker to inject malicious JavaScript. This occurs when a crafted PGP public key is submitted, which is then echoed into a textarea element without proper HTML encoding. When an administrator views a user's profile, the malicious script can execute within their session, potentially leading to unauthorized actions or information disclosure. The main concern is confirming relevance and exposure of this type of vulnerability within your deployed instances.

Attackers can embed harmful code in public keys.
Compromise of administrator sessions is possible.
Confirm if this video platform is in use.

Attack Path

How an attacker could exploit the issue

An attacker with limited privileges could inject malicious code into a user's public PGP key. When an administrator views the user's profile, this injected code would execute within the administrator's browser session, potentially allowing the attacker to compromise the administrator's account or perform actions on their behalf.

Requires authenticated access.
Crafted PGP key submitted to the system.
Allows execution of arbitrary JavaScript.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could impact AVideo's administrative sessions. When an administrator views a user's profile, malicious JavaScript injected through a crafted PGP public key could execute within their browser. This behavior is supported when the LoginControl plugin is used and a user profile is accessed by an administrator.

Administrator sessions could be compromised.
Malicious script could execute in the browser.
Unauthorized actions may be performed by an attacker.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Real-World Ownership section should focus on identifying the teams responsible for the AVideo platform and initiating the response to this stored cross-site scripting vulnerability. The first practical step involves locating all instances of AVideo, assessing their exposure and business criticality, and then engaging the accountable application or platform owner to plan remediation.

Application/Platform owners to investigate.
Verify AVideo instances and user profiles.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is AVideo?

AVideo is a web-based platform designed for hosting and sharing video content. It functions like a private YouTube or video streaming portal. The software includes various plugins, such as the LoginControl plugin, which manages user authentication and account settings, including the storage of PGP public keys for identity verification.

How does CVE-2026-89255 work?

This vulnerability is a Stored Cross-Site Scripting (XSS) issue, classified as CWE-79. It occurs because the LoginControl plugin does not properly encode PGP public keys before displaying them. When an attacker saves a crafted, malicious script inside a PGP public key field, the application treats that script as trusted code. When an administrator later views that user's profile, the browser executes the injected script automatically.

Do I need to be an admin to trigger this bug?

No, the attacker does not need administrative privileges to initiate the injection; an account with limited access is sufficient to submit the malicious PGP key. However, the script only triggers when a victim with higher privileges, such as an administrator, views the profile page where the key is rendered. Simply submitting the key does not execute the attack; the viewing action is the necessary trigger.

Is my AVideo instance at risk?

According to Halo Surface Signal, AVideo is commonly deployed as an internet-facing application, increasing the likelihood that your instance is reachable by external actors. Because the vulnerability exists within user-profile features, any instance allowing user account creation or profile management is potentially relevant. You should evaluate if your deployment is accessible from the internet.

What should I do if I run AVideo?

First, locate all running instances of AVideo within your environment to understand your footprint. Identify the platform owners responsible for these systems and confirm whether the LoginControl plugin is enabled. Once identified, prioritize these systems for remediation and monitor for any available security updates from the AVideo maintainers to resolve the encoding flaw.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.