CVE-2026-61573

AVideo is a video-sharing Platform. Prior to 8.1.0, the anonymous login interface reflects request values into HTML and JavaScript without output encoding. In `view/index.php`, `webSiteRootURL` is returned verbatim by `Streamer::getStreamerURL()` in `objects/Streamer.php` and reaches navigation and form attributes; it also enters a single-quoted JavaScript string in `view/index.header.php`. It is not filtered by `objects/security.php`, while the `user` and `pass` fields are filtered only for single quotes, leaving double quotes and angle brackets capable of breaking out of their HTML attributes. In addition, `view/index.header.php` reflects POST fields using `json_encode` without `JSON_HEX_TAG`, allowing a closing script tag to break out, and `locale/function.php` stores the POST `lang` value in the session for unescaped reflection in `view/index.php`. An unauthenticated remote attacker who persuades a victim to open a crafted login link can execute arbitrary JavaScript in the encoder's origin. This can read the operator session identifier exposed in inline script, capture login credentials and perform actions as the operator against the encoder and its upstream platform. This issue is fixed in version 8.1.0.

• CWE-79

• https://github.com/WWBN/AVideo-Encoder/commit/789d75681cc9377e1cc8950ffcc0cfc9b2032b9e
• https://github.com/WWBN/AVideo-Encoder/releases/tag/v8.1.0
• https://github.com/WWBN/AVideo-Encoder/security/advisories/GHSA-p9x3-679g-pwf5

Published

Oct 28, 2026

Last Modified

Oct 29, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-61568`@zereight/mcp-gitlab` is a Model Context Protocol server fo…9.6
• CVE-2026-61569AVideo is a video-sharing Platform. Prior to 8.1.0, the unau…7.5
• CVE-2026-6157A vulnerability was detected in Totolink A800R 4.1.2cu.5137_…8.8
• CVE-2026-61570MPXJ is an open source library to read and write project pla…7.5
• CVE-2026-61571AVideo is a video-sharing Platform. Prior to 8.1.0, the enco…7.3
• CVE-2026-61572AVideo is a video-sharing Platform. Before the initial remed…8.6
• CVE-2026-61574authentik is an open-source identity provider. Prior to 2026…8.8
• CVE-2026-61575AVideo is a video-sharing Platform. Prior to 8.1.0, `view/qu…4.7
• CVE-2026-61576Lightdash is an open source business intelligence platform. …8.3
• CVE-2026-6158A flaw has been found in Totolink N300RH 6.1c.1353_B20190305…7.3
• CVE-2026-61586Copernik XML Factory provides secure-by-default JAXP factory…8.2
• CVE-2026-61588djust provides Phoenix LiveView-style reactive server-side r…6.5