---
id: CVE-2026-61573
title: 'AVideo-Encoder: reflected cross-site scripting in the login interface'
summary: >-
  AVideo is a video-sharing Platform. Prior to 8.1.0, the anonymous login
  interface reflects request values into HTML and JavaScript without output
  encoding. In `view/index.php`, `webSiteRootURL` is returned verbatim by
  `Streamer::getStrea…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: WWBN
product: AVideo-Encoder
affected:
  - AVideo-Encoder < 8.1.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-29T15:29:39.219681Z'
published: '2026-10-28'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T17:21:22.557Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-61573'
references:
  - url: >-
      https://github.com/WWBN/AVideo-Encoder/security/advisories/GHSA-p9x3-679g-pwf5
    label: >-
      https://github.com/WWBN/AVideo-Encoder/security/advisories/GHSA-p9x3-679g-pwf5
  - url: >-
      https://github.com/WWBN/AVideo-Encoder/commit/789d75681cc9377e1cc8950ffcc0cfc9b2032b9e
    label: >-
      https://github.com/WWBN/AVideo-Encoder/commit/789d75681cc9377e1cc8950ffcc0cfc9b2032b9e
  - url: 'https://github.com/WWBN/AVideo-Encoder/releases/tag/v8.1.0'
    label: 'https://github.com/WWBN/AVideo-Encoder/releases/tag/v8.1.0'
tags:
  - cve.org
epss: 0.00251
epssPercentile: 0.16641
ingestedAt: '2026-11-01T22:02:40.994Z'
---

## Overview

AVideo is a video-sharing Platform. Prior to 8.1.0, the anonymous login interface reflects request values into HTML and JavaScript without output encoding. In `view/index.php`, `webSiteRootURL` is returned verbatim by `Streamer::getStreamerURL()` in `objects/Streamer.php` and reaches navigation and form attributes; it also enters a single-quoted JavaScript string in `view/index.header.php`. It is not filtered by `objects/security.php`, while the `user` and `pass` fields are filtered only for single quotes, leaving double quotes and angle brackets capable of breaking out of their HTML attributes. In addition, `view/index.header.php` reflects POST fields using `json_encode` without `JSON_HEX_TAG`, allowing a closing script tag to break out, and `locale/function.php` stores the POST `lang` value in the session for unescaped reflection in `view/index.php`. An unauthenticated remote attacker who persuades a victim to open a crafted login link can execute arbitrary JavaScript in the encoder's origin. This can read the operator session identifier exposed in inline script, capture login credentials and perform actions as the operator against the encoder and its upstream platform. This issue is fixed in version 8.1.0.

## Affected

- `AVideo-Encoder < 8.1.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.