CVE-2026-61573

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 8.1.0

Description The anonymous login interface reflects request values into HTML and JavaScript without proper output encoding. In view/index.php, the webSiteRootURL variable is returned verbatim by the Streamer::getStreamerURL() function in objects/Streamer.php, affecting navigation and form attributes, and is inserted into a single-quoted JavaScript string in view/index.header.php. The user and pass fields are only filtered for single quotes, allowing double quotes and angle brackets to break HTML attributes. Additionally, view/index.header.php reflects POST fields using json encode without JSON HEX TAG, enabling a closing script tag to break out. Furthermore, locale/function.php stores the POST lang value in the session, which is then reflected unescaped in view/index.php. An unauthenticated remote attacker can use a crafted login link to execute arbitrary JavaScript, potentially stealing operator session identifiers and login credentials to perform unauthorized actions.

Recommendations Update to version 8.1.0.