CVE-2026-85159: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in WWBN AVideo

The vulnerability in WWBN AVideo (commit c91b5975d) involves improper neutralization of input during web page generation, specifically in the userLogin.php file. The cancelUri parameter is reflected in an href attribute after a protocol check by isSafeRedirectURL, which does not sanitize HTML characters. This allows unauthenticated attackers to inject JavaScript event handlers through relative URLs containing embedded quotes, leading to reflected cross-site scripting when users click the Cancel button.

An unauthenticated attacker can exploit this vulnerability to execute arbitrary JavaScript in the context of the victim's browser when the Cancel button is clicked. This may lead to actions such as session hijacking, defacement, or other client-side attacks. The CVSS 4.0 base score is 5.3 (medium severity), reflecting the network attack vector, low complexity, no privileges required, but requiring user interaction and limited confidentiality and integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when interacting with the Cancel button on affected versions. Developers should ensure that all user-controllable inputs reflected in HTML attributes are properly sanitized or encoded beyond protocol checks.