External risk intelligence

AVideo Bookmark Plugin Stored Cross-Site Scripting Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-89256

AVideo is designed as a video sharing and streaming platform, typically deployed as a public-facing web application. Since the vulnerability exists within a plugin that affects the public watch-page HTML, it is commonly accessible to internet users visiting the platform.

Cross-site Scripting

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the AVideo Bookmark plugin allows unauthorized scripts to run when visitors view specific videos. This occurs because chapter names are not properly secured before being displayed, enabling malicious code injection. The main concern is confirming if this specific AVideo plugin is in use and potentially exposed.

Unsecured chapter names permit script injection.
It affects public video watch pages.
Confirm relevance and exposure of this plugin.

Attack Path

How an attacker could exploit the issue

An attacker could inject malicious scripts into a video's bookmark name, which is then displayed to all visitors of that video. This vulnerability allows the attacker to execute arbitrary code within the AVideo origin for any user viewing the compromised video.

Requires a video owner's account.
Inject script into bookmark name.
Leads to cross-site scripting execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could impact user experience by allowing malicious scripts to execute within a visitor's browser when viewing a video. The risk is that these scripts could potentially disrupt the normal functionality of the watch page or lead to unintended actions for the user.

User-facing watch pages at risk.
Malicious scripts injected via bookmark names.
Disrupted user experience and potential actions.

Operational Fix

Recommended remediation, mitigation, and detection steps

The AVideo platform's Bookmark plugin is susceptible to stored cross-site scripting, allowing malicious scripts to execute within the origin of any visitor viewing a video with a compromised bookmark. Identifying all instances of AVideo, confirming their external reachability and business criticality, and locating the accountable video owner are the immediate first steps. Remediation planning should then prioritize the most exposed or critical deployments.

Video owners and platform administrators should own.
Verify external reachability and critical assets.
Plan remediation based on risk and impact.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is AVideo?

AVideo is an open-source platform built for video sharing and streaming. It allows users to host, manage, and distribute video content, functioning much like a private or custom-branded video hosting site.

What does CVE-2026-89256 mean?

This is a stored cross-site scripting (XSS) vulnerability, classified as CWE-79. It occurs because the AVideo Bookmark plugin fails to sanitize chapter names before showing them on public pages. When a malicious script is saved as a chapter name, it becomes part of the web page's code, causing browsers to execute that script whenever anyone views the video.

How does an attacker trigger this vulnerability?

An attacker needs an account with video ownership permissions to modify bookmark chapter names. They must input a malicious script into the bookmark field, which then gets stored by the server. Simply browsing the site or viewing a video does not trigger the bug; the malicious payload must be intentionally injected into a chapter name by an authenticated user with permission to edit that video.

Why should I care about this AVideo vulnerability?

According to Halo Surface Signal, AVideo is typically deployed as a public-facing web application. Because this vulnerability affects public watch pages, any visitor to a compromised video is at risk of executing the malicious script. If your AVideo instance is internet-facing, it is likely accessible to external users who could be targeted by this flaw.

Do I need to take action to secure my AVideo instance?

Yes. Start by identifying all instances of AVideo in your environment and checking if the Bookmark plugin is active. Confirm which of these instances are internet-facing and determine the business criticality of the content hosted there. Finally, coordinate with the platform administrators and video owners to assess the risk and plan for necessary updates or configuration changes.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.