{"id":"CVE-2026-61573","kind":"vulnerability","aliases":["CVE-2026-61573"],"related":[],"title":"AVideo: login page reflects input unescaped, enabling script injection","description":"AVideo is a video-sharing Platform. Prior to 8.1.0, the anonymous login interface reflects request values into HTML and JavaScript without output encoding. In `view/index.php`, `webSiteRootURL` is returned verbatim by `Streamer::getStreamerURL()` in `objects/Streamer.php` and reaches navigation and form attributes; it also enters a single-quoted JavaScript string in `view/index.header.php`. It is not filtered by `objects/security.php`, while the `user` and `pass` fields are filtered only for single quotes, leaving double quotes and angle brackets capable of breaking out of their HTML attributes. In addition, `view/index.header.php` reflects POST fields using `json_encode` without `JSON_HEX_TAG`, allowing a closing script tag to break out, and `locale/function.php` stores the POST `lang` value in the session for unescaped reflection in `view/index.php`. An unauthenticated remote attacker who persuades a victim to open a crafted login link can execute arbitrary JavaScript in the encoder's origin. This can read the operator session identifier exposed in inline script, capture login credentials and perform actions as the operator against the encoder and its upstream platform. This issue is fixed in version 8.1.0.","summary":"AVideo's anonymous login page echoes request values into HTML and JavaScript without output encoding, and some fields are only filtered for single quotes. An attacker who gets a victim to open a crafted login link can run JavaScript in the site's origin, read session identifiers and capture login credentials.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["avideo","package","self-hosted","video-platform"],"not_affected_if":["version-8.1.0-or-later"],"how_to_check":"- Check the installed AVideo version in the application's version file or admin dashboard; versions below `8.1.0` are affected.\n- unknown","fix":"- Upgrade AVideo to `8.1.0` or later.\n- unknown","status":"open","published_at":"2026-10-28T22:17:16+00:00","first_seen_at":"2026-10-28T22:35:35+00:00","triaged_at":"2026-10-28T22:36:59+00:00","updated_at":"2026-10-28T22:36:59+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-28T22:36:59Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade AVideo to `8.1.0` or later.\n- unknown","reach":"internet","title":"AVideo: login page reflects input unescaped, enabling script injection","impact":"high","summary":"AVideo's anonymous login page echoes request values into HTML and JavaScript without output encoding, and some fields are only filtered for single quotes. An attacker who gets a victim to open a crafted login link can run JavaScript in the site's origin, read session identifiers and capture login credentials.","category":"package","nicknames":[],"who_cares":["avideo","self-hosted","video-platform"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker runs JavaScript as the operator, reading sessions and credentials","analyst_note":"","how_to_check":"- Check the installed AVideo version in the application's version file or admin dashboard; versions below `8.1.0` are affected.\n- unknown","needs_analyst":false,"not_affected_if":["version-8.1.0-or-later"],"who_is_affected":"Sites running AVideo before `8.1.0` that expose the anonymous login page to the internet are exposed, since the attack needs only a crafted link opened by a logged-in or logging-in operator. Instances not running AVideo, or already on `8.1.0` or later, are not affected. The sources do not say whether non-default configuration changes exposure.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000616,"input_tokens":3616,"output_tokens":508,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-61573':12A,15A '8.1.0':84C,251C 'action':234C 'addit':160C 'allow':172C 'also':117C 'angl':149C 'anonym':26B,86C 'arbitrari':211C 'attack':49B,198C 'attribut':115C,158C 'avideo':1A,16B,24B,75C 'bracket':150C 'break':153C,178C 'capabl':151C 'captur':72B,229C 'close':174C 'craft':57B,206C 'credenti':74B,231C 'cve':10A,13A 'doubl':146C 'echo':29B 'enabl':7A 'encod':38B,98C,167C,215C,240C 'enter':118C 'execut':210C 'expos':225C 'field':41B,138C,164C 'filter':44B,130C,140C 'fix':248C 'form':114C 'get':51B 'getstreamerurl':107C 'hex':170C 'host':20B 'html':33B,93C,157C 'identifi':70B,224C 'inject':9A 'inlin':227C 'input':5A 'interfac':88C 'issu':246C 'javascript':35B,62B,95C,123C,212C 'json':166C,169C 'lang':185C 'leav':145C 'link':59B,208C 'locale/function.php':181C 'login':2A,27B,58B,73B,87C,207C,230C 'navig':112C 'objects/security.php':132C 'objects/streamer.php':109C 'open':55B,204C 'oper':222C,237C 'origin':67B,217C 'output':37B,97C 'packag':17B 'page':3A,28B 'pass':137C 'perform':233C 'persuad':200C 'platform':23B,81C,244C 'post':163C,184C 'prior':82C 'quot':47B,122C,144C,147C 'reach':111C 'read':68B,220C 'reflect':4A,89C,162C,192C 'remot':197C 'request':30B,90C 'return':103C 'run':61B 'script':8A,175C,228C 'self':19B 'self-host':18B 'session':69B,189C,223C 'share':80C 'singl':46B,121C,143C 'single-quot':120C 'site':65B 'store':182C 'streamer':106C 'string':124C 'tag':171C,176C 'unauthent':196C 'unescap':6A,191C 'upstream':243C 'use':165C 'user':135C 'valu':31B,91C,186C 'verbatim':104C 'version':250C 'victim':53B,202C 'video':22B,79C 'video-platform':21B 'video-shar':78C 'view/index.header.php':126C,161C 'view/index.php':100C,194C 'websiterooturl':101C 'without':36B,96C,168C","nicknames":[],"mitigations":[],"who_affected":"Sites running AVideo before `8.1.0` that expose the anonymous login page to the internet are exposed, since the attack needs only a crafted link opened by a logged-in or logging-in operator. Instances not running AVideo, or already on `8.1.0` or later, are not affected. The sources do not say whether non-default configuration changes exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T22:17:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-61573","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61573","severity":null,"published_at":"2026-10-28T22:17:16+00:00","modified_at":"2026-10-28T22:17:16+00:00","first_seen_at":"2026-10-28T22:35:35+00:00","fetched_at":"2026-10-28T22:35:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}