CVE-2026-85159

Name of the Vulnerable Software and Affected Versions AVideo versions prior to commit c91b5975d

Description A reflected cross-site scripting issue exists in the 'userLogin.php' endpoint. The cancelUri parameter is echoed within an href attribute after the isSafeRedirectURL() function validates only the protocol and fails to sanitize HTML characters. This allows unauthenticated attackers to inject event handlers using relative URLs containing embedded quotes, leading to the execution of arbitrary JavaScript when a user interacts with the Cancel button.

Recommendations Update AVideo to a version beyond commit c91b5975d. As a temporary mitigation, restrict or avoid using the cancelUri parameter in the 'userLogin.php' endpoint.